EUVD-2026-44190
GHSA-q8g8-h36v-wcv9
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open RCE: AV:L and UI:R because the victim must open a crafted spreadsheet, PR:N as no prior privileges are needed, and C/I/A:H from full code execution in the user's context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Arbitrary local code execution in Microsoft Office Excel (spanning Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the Office for Mac editions, and Office Online Server) lets an attacker run code in the current user's context when a victim opens a maliciously crafted spreadsheet. The flaw is an untrusted pointer dereference (CWE-822) triggered during file parsing; it requires user interaction but no prior privileges. No public exploit is identified at time of analysis, and a vendor patch is available from Microsoft (MSRC).
Technical ContextAI
The root cause is CWE-822 (Untrusted Pointer Dereference): Excel's file-parsing code takes a pointer value derived from attacker-controlled data inside a crafted workbook and dereferences it without validating that it points to legitimate, expected memory. By controlling that pointer, an attacker can redirect memory reads/writes, which is corruptible into control-flow hijack and code execution. The CPE set scopes the affected technology to Microsoft's Office/Excel productivity suite across Windows and macOS client builds plus the server-side Office Online Server rendering component, so any component that parses Excel document formats (legacy binary or OOXML) is the attack surface. This bug class is characteristic of complex document parsers where malformed structures yield unsafe pointer arithmetic.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security updates in the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55136 as the primary fix, via Microsoft Update / Click-to-Run for 365 Apps and the matching LTSC, Mac, and Office Online Server packages; take exact patched build numbers from that advisory rather than assuming them. Where immediate patching is not possible, reduce exposure by keeping untrusted spreadsheets in Protected View, enforcing Mark-of-the-Web so internet-sourced files stay sandboxed, and enabling Attack Surface Reduction rules that block Office from spawning child processes and executing macros/DDE - trade-off is that Protected View and ASR can break legitimate automation and add-ins. Additionally block or quarantine spreadsheet attachments at the mail/web gateway and restrict who can upload documents to Office Online Server, at the cost of some friction to legitimate document workflows.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today