Microsoft Excel CVE-2026-55138

Exploitation requires a local user to actively open a specially crafted Excel workbook; the CVSS AV:L metric confirms the attack surface is local and the attack cannot be triggered remotely without the victim performing a file-open action. UI:R establishes that user interaction is mandatory - the vulnerability does not self-trigger. PR:N indicates the attacker does not need any pre-existing system privileges or authenticated session; the malicious file itself is the delivery vehicle. No special Excel configuration, non-default settings, or specific feature enablement is indicated as a prerequisite by the available description or CVSS data, though the requirement for user interaction substantially limits opportunistic mass exploitation. Exploitation is further constrained to confidentiality impact only - integrity and availability of the system are not affected (I:N/A:N).

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a Medium score of 5.5. The C:H rating signals that successful exploitation can fully compromise confidentiality of data accessible to the vulnerable process, yet this impact is constrained by AV:L (local attack surface - requires the malicious file to reach the victim's machine) and UI:R (the victim must actively open the crafted document). The PR:N metric indicates no pre-existing system privileges are needed by the attacker, but this is offset by the social-engineering dependency. SSVC reinforces the moderate posture: exploitation is rated none, the vector is not automatable (no for Automatable), and technical impact is partial - collectively indicating this is not a self-propagating, mass-exploitation threat. No EPSS score was provided in the available data, so probabilistic exploitation likelihood cannot be quantified. The absence of KEV listing and SSVC's none exploitation rating suggest this is not currently being leveraged in observed threat campaigns. Real-world priority is moderate: the wide product footprint and C:H impact warrant prompt patching, but the delivery barrier of requiring user file interaction reduces urgency compared to network-exploitable, zero-interaction flaws.

An attacker crafts a malicious Excel workbook embedding a pointer value designed to trigger the CWE-822 condition during file parsing, then delivers it via phishing email or a compromised file-sharing platform to a target user. When the victim opens the document, Excel's parser dereferences the untrusted pointer, leaking process memory - potentially exposing credentials, tokens, or other sensitive data accessible within the Office process space. No public exploit code has been identified at time of analysis, so reliable exploitation likely requires independent research into the specific parsing flaw.