EUVD-2026-44206
GHSA-2xhx-8hwj-hj2c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-borne client-side RCE: AV:L and UI:R because the victim must open a crafted file, PR:N as no auth is needed, and C/I/A:H reflecting full code execution in the user's context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Arbitrary code execution in Microsoft Office Excel arises from a heap-based buffer overflow (CWE-122) that an attacker triggers when a victim opens a maliciously crafted spreadsheet, running code in the security context of the current user. The flaw spans a broad Office footprint including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office editions, and Office Online Server. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 7.8 rating reflects high impact gated by required user interaction.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-122), a memory-corruption class where a parser writes past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or object pointers that can be steered into controlled code execution. In this case the vulnerable component is Microsoft Excel's file/format parsing logic, which processes attacker-controlled spreadsheet content. The CPE set confirms the affected surface is the Excel application across the Office family: cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024, and office_online_server - indicating both Windows and macOS builds plus server-side rendering are in scope. Because CVSS scope is Unchanged (S:U), impact is confined to the process/user context executing Excel.
RemediationAI
Apply the Microsoft security update for CVE-2026-55131 across all affected Office channels; the input confirms a patch is available from the vendor, so this is the primary and preferred fix - Patch available per vendor advisory. Exact fixed build numbers are not included in the provided data, so obtain them from the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55131 and ensure Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server are all updated. Where patching cannot be completed immediately, reduce exposure by enabling Protected View and Office macro/file-block policies for files originating from the internet and email, which forces untrusted spreadsheets into a sandboxed read-only mode before parsing (trade-off: users must click to enable editing, adding friction for legitimate documents), and by using attachment filtering to quarantine spreadsheet files from untrusted senders (trade-off: may delay legitimate business files). These are mitigations that lower likelihood of a user opening a weaponized file but do not remove the underlying overflow, so patching remains required.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today