Microsoft Excel CVE-2026-55122

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel workbook in an affected Office/Excel build (UI:R user interaction is mandatory) - the attacker cannot trigger it remotely without victim action, and the AV:L vector means the malicious file must be delivered to and processed on the local machine. No authentication or elevated privileges are needed on the target side (PR:N). Limiting factors: the required user interaction, the fact that opening the file in Protected View or Office for the web substantially reduces the exploitation surface, and that the leak is bounded to whatever adjacent process memory the out-of-bounds read exposes rather than arbitrary code execution.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H yields 7.1 (High): low attack complexity and no privileges required, but a LOCAL vector gated by required user interaction - the victim must open a malicious file. PR:N means no authentication qualifier is needed, but exploitation is not automatable because it depends on social engineering (UI:R). No EPSS score was provided, so exploitation probability cannot be quantified; there is no POC and no CISA KEV listing, so this is not confirmed actively exploited. The realistic risk is therefore moderate-but-not-emergency: it is a document-driven info-leak, most dangerous as one link in a chain (e.g., an ASLR-bypass primitive paired with a memory-corruption RCE) rather than a standalone critical. Note a signal tension: the description characterizes the impact purely as information disclosure ('disclose information'), yet the vendor vector asserts A:H (high availability impact) alongside C:H - an out-of-bounds read normally maps to confidentiality with at most a crash-level availability effect, so the A:H rating should be verified against the MSRC advisory.

An attacker emails a finance employee a crafted .xlsx workbook themed as an invoice or report; when the employee opens it in Excel, the parser performs an out-of-bounds read and the leaked memory (potentially containing pointers, tokens, or document fragments) is exfiltrated back through embedded content or serves as an ASLR-bypass primitive for a follow-on exploit. The local attack vector and required user interaction mean success hinges on convincing the victim to open the file; no public POC has been identified at time of analysis.