Microsoft Excel CVE-2026-55048

Exploitation requires the victim to open an attacker-supplied crafted Excel/Office file on an affected build - the CVSS vector's AV:L combined with UI:R means there is no remote network trigger; delivery depends on getting the file to the user and having them open it (and, in typical configurations, dismiss Protected View to reach full edit/parse paths). No authentication or elevated privileges are needed on the attacker's part (PR:N), and code runs at the privilege level of the user who opens the file. Limiting factors: mandatory user interaction, dependence on social engineering to deliver the document, and the fact that Protected View / file-block policies can block the vulnerable parsing path before code execution.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High): local attack vector, low complexity, no privileges required, but user interaction is mandatory. In practice AV:L with UI:R means the 'attack' is delivered as a file the victim must open - the classic phishing/malicious-document pattern - so the real-world exploitability hinges on social engineering rather than remote reachability. No EPSS score was provided, so exploitation probability cannot be quantified. It is not in CISA KEV (no confirmed active exploitation) and no POC is referenced, so this is a high-severity-by-impact issue rather than a confirmed imminent-exploitation priority. That said, Office file-format memory-corruption bugs are historically attractive to phishing and APT actors, and the broad affected footprint plus available patch make prompt patching worthwhile. Note the tension worth verifying: the impact (RCE) is severe, but the local/UI-required delivery limits mass automated exploitation.

An attacker crafts a malicious Excel workbook whose internal size/count fields trigger the integer overflow and emails it to a target as a routine-looking attachment (e.g., an invoice or report). When the victim opens the file and, if prompted, exits Protected View, the corrupted allocation lets the attacker's payload execute as that user. No public POC is referenced, but the technique mirrors well-established malicious-document attacks.