What is the CVSS score of CVE-2026-55048?

CVE-2026-55048 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Excel are affected by CVE-2026-55048?

Microsoft Excel versions used across the organization contain a critical vulnerability allowing attackers to execute code on user systems when victims open maliciously crafted spreadsheet files.. A patch is available.

How to fix or mitigate CVE-2026-55048?

Within 24 hours, identify and inventory all deployed Microsoft Excel instances (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, macOS Office, and Office Online Server) and issue immediate guidance to users to avoid opening Excel files from untrusted sources and defer access to non-critical spreadsheets until patched. Within 7 days, test and begin deploying the vendor-released patch across all affected Excel versions, prioritizing systems used by employees who frequently access external documents. Within 30 days, complete deployment of security updates to the entire Excel user base, verify patching completion, and conduct security awareness training on file handling practices to reinforce defense-in-depth.

Microsoft Excel CVE-2026-55048

EUVD-2026-44174 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-07-14 microsoft

GHSA-wx7g-r7w5-gv3h

Buffer Overflow Integer Overflow Microsoft Office Online Server Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Excel 2016 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File must be opened locally by the user (AV:L, UI:R) with no attacker privileges (PR:N); memory-corruption RCE yields full C/I/A impact within the user's scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:24 vuln.today

CVE Published

Jul 14, 2026 - 17:08 cve.org

HIGH 7.8

DescriptionCVE.org

Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Excel (spanning Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office builds, and Office Online Server) arises from an integer overflow (CWE-190) triggered when the application parses a maliciously crafted spreadsheet. An unauthorized attacker who convinces a victim to open a booby-trapped file can run arbitrary code in the context of the current user, with full confidentiality, integrity, and availability impact per the 7.8 CVSS vector. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw is an integer overflow or wraparound (CWE-190) inside Excel's spreadsheet file parsing logic. Excel processes complex binary and OOXML structures whose size, count, or offset fields are read from the untrusted file; when an attacker supplies a value that exceeds the range of the integer type used in a length or allocation calculation, the value wraps, producing an undersized buffer allocation or a miscalculated bounds check. Subsequent writes then land outside the intended buffer (the 'Buffer Overflow' tag reflects this downstream corruption), giving the attacker control over memory and ultimately execution flow. The CPE set confirms the affected code is shared across the Windows desktop suites (microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024), the macOS builds (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021/2024), and the server-side office_online_server component.

RemediationAI

Patch available per vendor advisory: apply the Microsoft update for CVE-2026-55048 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55048, which provides fixed builds for each channel (Microsoft 365 Apps/Current Channel, the perpetual Office 2016/2019/LTSC 2021/2024 releases, the macOS builds, and Office Online Server). Exact fixed build numbers are channel-specific and should be taken from the MSRC page rather than assumed. Where immediate patching is not possible, reduce exposure by having Excel open untrusted files in Protected View and blocking that setting from being disabled by policy (trade-off: users must click through to edit legitimate files), by using Office file-block policy or attachment filtering to quarantine spreadsheets from untrusted sources (trade-off: may delay legitimate business documents), and by enabling Attack Surface Reduction rules that restrict Office child-process creation (trade-off: can break macro-based or automation workflows). These are compensating controls only and do not remove the underlying integer overflow.