Microsoft Excel CVE-2026-55141

Exploitation requires the victim to open an attacker-supplied malicious Excel/Office document on the local machine (UI:R - user interaction is mandatory), which is the concrete prerequisite that limits this flaw. No prior authentication to the target is needed (PR:N), but the attacker must deliver the file and get the user to open it and, in practice, exit Protected View for the parsing path to run with full trust. The attack vector is local/file-based (AV:L), not network-triggerable without user action, so it cannot be exploited automatically or remotely against a default install; the practical limiting factors are the required user interaction, the need for successful social-engineering delivery, and mitigations like Protected View and Mark-of-the-Web that gate the vulnerable code path.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - although PR:N indicates no prior authentication, the AV:L and UI:R metrics show this is not a remotely automatable attack: it requires a local file to be opened by a user, so it behaves like a client-side, social-engineering-dependent flaw rather than a wormable network bug. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation and no public exploit identified at time of analysis; the high impact metrics (C:H/I:H/A:H) reflect full user-context compromise on success, not ease of exploitation. Under an SSVC-style read this is 'exploitation: none, automatable: no, technical impact: total' - meaning a real but not emergency priority: patch on the normal cycle unless the Office fleet is unusually exposed. No EPSS or KEV data is present to escalate urgency, and none of the provided signals conflict.

An attacker emails a finance employee a spreadsheet disguised as an invoice or report; when the victim opens it and dismisses or bypasses Protected View, the crafted content overflows a stack buffer in Excel's parser and executes attacker code as that user. Because AV:L and UI:R apply, success hinges on social engineering rather than a network exploit, and no public exploit is identified at time of analysis.