Microsoft Excel CVE-2026-55131

Exploitation requires the victim to open a specially crafted Excel spreadsheet in an affected Office build (UI:R in the CVSS vector) - this user-interaction requirement is the key limiting factor and means the attack cannot succeed without social engineering or a lured file open. No authentication or elevated privileges are needed on the target (PR:N), and attack complexity is low (AC:L), so once the file is opened no additional conditions or non-default configuration are required. Exploitation is delivered via a local file (AV:L) rather than a direct network service, and impact is confined to the opening user's security context (S:U), so an attacker gains only that user's privileges, not automatic escalation. Defenders relying on Protected View can block the initial parse for internet/email-sourced files, further constraining realistic exploitation.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a client-side, user-interaction-dependent flaw: no privileges are required (PR:N) but the victim must open a malicious file (UI:R), which is the primary factor limiting mass exploitation and keeping the score at High rather than Critical. Impact is uniformly high across confidentiality, integrity and availability once triggered. EPSS and SSVC data were not provided in the input, so exploitation probability and automatability cannot be quantified here; the absence of KEV listing and of any POC reference suggests this is not currently under active or widespread exploitation. Note the AV:L designation reflects that the attack is delivered through a local file rather than directly over the network, though such files are routinely delivered via email or web download, so real-world reachability is higher than 'local' implies. Overall this is a standard-priority Patch-Tuesday-class Office RCE: genuinely impactful if a user is socially engineered into opening a document, but not a drop-everything emergency absent evidence of exploitation.

An attacker emails a finance employee a crafted .xlsx/.xls spreadsheet themed as an invoice or report; when the victim opens it in Excel, the malformed content triggers the heap overflow and executes attacker code in the user's context, establishing a foothold for data theft or ransomware staging. The AV:L/AC:L/UI:R vector means the attack is low-complexity once the file is opened but wholly dependent on that user action. No public POC is referenced in the available data.