Microsoft Excel CVE-2026-55137

Exploitation requires the victim to open an attacker-supplied malicious Excel file and, on Windows, to exit Protected View / enable editing - the CVSS vector confirms this with UI:R (user interaction required) and AV:L (local file-handling vector, not a remote network service). No authentication is needed (PR:N), so any user who opens the file can be targeted, and code executes with that user's privileges. The primary limiting factors are the mandatory user interaction, the need to deliver the file to and be opened by the victim, and Protected View sandboxing which blocks execution until the user explicitly enables editing; these substantially reduce the realistic attack surface compared to a zero-click network flaw.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) describes a classic client-side document exploit: no attacker privileges are needed, but the victim must open the malicious file (UI:R), and the vector is Local because delivery relies on file handling rather than a network service. This is not a wormable, unauthenticated-network flaw, so raw automation potential is limited by the user-interaction requirement. No EPSS score, SSVC decision, or POC was provided, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation - however, Excel parsing bugs are historically a favored vector for phishing-driven initial access, so the practical risk to organizations that open external spreadsheets is meaningful. Priority should be treated as elevated for endpoint fleets despite the absence of confirmed exploitation, primarily because of the product's ubiquity and the low complexity of the attack once a file is opened.

An attacker emails a target a crafted .xlsx/.xls spreadsheet disguised as an invoice or report; when the victim opens it in a vulnerable Excel build and dismisses Protected View, the malformed record triggers the heap overflow and runs attacker code in the user's security context. No credentials or elevated privileges are required beyond convincing the user to open and edit the file. No public exploit has been identified at time of analysis, so exploitation would require the attacker to develop a working heap-grooming exploit.