Microsoft Excel CVE-2026-55053

Exploitation requires a user to open a maliciously crafted Excel document (UI:R in the CVSS vector) in an affected build of Excel/Office, so it is not remotely triggerable without victim action. No prior authentication or privileges on the target are needed by the attacker (PR:N), and attack complexity is low (AC:L), but the local attack vector (AV:L) means the crafted file must be delivered to and opened on the target host. Limiting factors: the mandatory user-interaction step, dependence on the victim not opening in/exiting Protected View, and the need for the target to run an unpatched Office/Excel build across the listed Windows, macOS, or Office Online Server products.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8 HIGH) describes a client-side vulnerability: the local attack vector combined with required user interaction means exploitation depends on a victim opening a crafted file, not on remote network reachability. PR:N indicates no pre-existing privileges are needed by the attacker, but the low-complexity, high-triad impact is gated behind the UI:R social-engineering step, which realistically lowers exploitation likelihood versus a wormable network bug. No EPSS score, SSVC decision, or KEV entry was provided; the absence of KEV and of any POC reference means there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a genuine priority for endpoints where users routinely open external spreadsheets (finance, HR, support desks), but in the absence of automated/remote exploitability it ranks below network-facing unauthenticated RCE. EPSS and SSVC data are missing - exploitation probability could not be quantified from the input.

An attacker emails a finance employee a crafted .xlsx/.xls spreadsheet that appears to be an invoice; when the victim opens it in Excel, the malformed structure overflows a heap buffer during parsing and executes attacker-supplied code in the user's context. Because AV is local and UI is required, the attack hinges on social engineering rather than remote reach, and no public exploit code has been identified at time of analysis.