Microsoft Excel CVE-2026-55054

The victim must actively open a specially crafted Excel workbook delivered by the attacker - user interaction (UI:R from CVSS) is a hard requirement, meaning fully automated or wormable exploitation without victim participation is not possible. No authentication is required on the attacker's side (PR:N). No special non-default configuration of Excel or Office is required; the flaw is present in the default file parsing behavior across all listed product versions. Exploitation is limited by: (1) the mandatory file-open action by the victim, (2) the impact being confidentiality-only with no code execution, and (3) the attacker needing a mechanism to receive the disclosed memory data. For Office Online Server deployments, users opening attacker-controlled files through the web interface may reduce the perceived interaction barrier since the action occurs in a browser session, but a deliberate file-open action remains required.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects moderate severity: network-delivered, low complexity, no attacker authentication required, but mandatory victim interaction and confidentiality-only impact with no integrity or availability consequence. SSVC independently corroborates low urgency - exploitation status is 'none,' the attack is not automatable (consistent with UI:R), and technical impact is assessed as 'partial.' EPSS at 0.64% (46th percentile) is below average, indicating this vulnerability is not currently attracting significant exploitation interest relative to the broader CVE population. The absence of a CISA KEV listing and no reported public POC further support a lower-urgency posture. There is no signal conflict in the data: all three frameworks (CVSS, SSVC, EPSS) are aligned on moderate-but-not-critical risk. The primary real-world threat is targeted spear-phishing delivering a crafted Excel file to exfiltrate sensitive memory contents - not mass exploitation.

An attacker crafts a malicious Excel workbook with a malformed structure designed to trigger the out-of-bounds read and embeds it in a spear-phishing email targeting users with access to sensitive data. When the victim opens the attachment, Excel's parser reads beyond the allocated buffer, and the out-of-bounds memory contents - potentially including credentials, tokens, or data from recently processed files in memory - are disclosed to the attacker via the crafted file's response mechanism. No public POC is known, making this scenario most realistic in targeted attacks by sophisticated threat actors rather than commodity campaigns.