Microsoft Excel CVE-2026-55058

Exploitation requires the victim to open a specially crafted Excel spreadsheet in an affected Office/Excel build (UI:R in the CVSS vector), and code runs only in the context of the user who opens the file (S:U). No authentication or prior privileges are needed (PR:N), and no network service is exposed - the vector is local (AV:L), so the attacker must deliver the file via email, web download, or shared storage. Limiting factors that reduce realistic risk: the user must actively open the file and typically bypass Protected View / Mark-of-the-Web warnings, and only the listed Excel/Office versions across Windows, Mac, and Office Online Server are affected.

This is a credible but user-interaction-gated risk rather than a wormable emergency. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U with high impact to confidentiality, integrity and availability, meaning exploitation is local, low-complexity, needs no prior privileges, but does require the victim to open a malicious file. There is no EPSS score, SSVC decision, POC, or KEV entry in the provided data, so exploitation probability cannot be quantified and no active exploitation is confirmed; treat it as a standard high-severity client-side Office bug. The 'unauthorized attacker' phrasing in the description is consistent with PR:N (no authentication needed) but does not remove the UI:R requirement - social engineering to open a file is the effective barrier. Given Excel's enormous install base and the historical popularity of Office file-format bugs in phishing, prioritize patching despite the absence of an in-the-wild signal.

An attacker emails a finance employee a spreadsheet disguised as an invoice or report; when the victim opens it and dismisses or bypasses Protected View, Excel's parser performs an out-of-bounds read on the crafted content and the attacker gains code execution as that user. Because the attack is local and low-complexity but requires user interaction, it is delivered through phishing rather than remote network exploitation. No public exploit code is identified at time of analysis.