EUVD-2026-44199
GHSA-fw32-5jmc-676r
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened by the user so AV:L and UI:R; no auth needed (PR:N); code runs as the current user with full impact (C/I/A:H, S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, Office Online Server) arises from an out-of-bounds read (CWE-125) that an attacker weaponizes by luring a victim into opening a crafted spreadsheet, yielding code execution in the user's security context. The flaw carries a CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) and requires no privileges but does require user interaction. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The root cause is an out-of-bounds read (CWE-125), a memory-safety defect in which Excel's file-parsing code reads past the bounds of an allocated buffer while processing malformed structures within a spreadsheet (e.g., record, cell, or object data). Although an out-of-bounds read is classically an information-disclosure primitive, Microsoft's classification and CVSS (C:H/I:H/A:H) indicate the condition is leveraged toward code execution, likely by corrupting parser state or leaking memory that defeats mitigations to reach a control-flow hijack. Affected code is the Excel component shared across the Office desktop and server family per the CPE data: Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office 365 for Mac, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, and Office Online Server.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-55058 for your specific product and channel; Windows and Microsoft 365 Apps users should install the current monthly Office/Click-to-Run update, and Office LTSC and Office for Mac users should apply the corresponding platform update, with Office Online Server administrators patching the server per the same bulletin (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55058). Because exploitation requires opening a crafted file, effective compensating controls until patching completes include configuring Excel to open untrusted documents in Protected View / Application Guard and blocking edits from files originating from the Internet (Mark-of-the-Web), which imposes a productivity cost when users legitimately need to edit downloaded spreadsheets. Additionally, use attachment/gateway filtering to strip or sandbox inbound Excel files and enforce macro and external-content restrictions; these reduce the phishing delivery surface without disabling Excel functionality entirely.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today