Microsoft Excel CVE-2026-55136

Exploitation requires the victim to open an attacker-supplied malicious Excel document - the CVSS vector's UI:R (user interaction required) and AV:L (local) confirm the attacker cannot trigger this remotely without that action. No authentication or prior privileges are needed (PR:N) and attack complexity is low (AC:L), so once a user opens the crafted file on any affected build no further special conditions apply. Limiting factors that reduce real-world risk: the mandatory user interaction, Office Protected View sandboxing internet-sourced files by default (the victim must click to enable editing / exit Protected View), and Mark-of-the-Web or ASR rules where enforced. Code executes only in the context of the current user, not automatically as SYSTEM.

The CVSS 3.1 base score is 7.8 (High), vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local vector, low complexity, no privileges, mandatory user interaction, and high impact to confidentiality, integrity, and availability. 'Local + UI:R' means the classic document-lure model: the attacker cannot reach the target directly over the network but only needs the victim to open a file. No EPSS, KEV, or POC data is present in the input, so exploitation is neither confirmed active nor publicly demonstrated; the main risk driver is Excel's enormous install base combined with total technical impact. Data conflict to flag: the 'Authentication Bypass' tag in the intelligence does NOT match the CWE-822 untrusted-pointer-dereference RCE described by NVD/Microsoft - treat that tag as mislabeled and rely on the CWE and description. SSVC framing: exploitation=none observed, automatable=no (needs a user to open a file), technical impact=total - a serious priority but not a drop-everything emergency absent evidence of active exploitation.

An attacker emails a finance employee a crafted spreadsheet (or hosts it on a shared drive or web link) engineered to make Excel dereference an attacker-controlled pointer during parsing. When the victim opens the file and, if prompted, exits Protected View, memory corruption occurs and the attacker's code runs with that user's privileges, enabling data theft or a foothold for lateral movement. No public POC is identified in the provided data, so this reflects the CVSS-derived local, user-interaction-dependent model.