EUVD-2026-44040
GHSA-hr7p-25v4-pxc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Excel spreadsheet
-
DeliveryDeliver via phishing email or link
-
ExploitVictim opens file bypassing Protected View
-
ExecutionOverflow stack buffer in Office parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open an attacker-supplied malicious spreadsheet file in a vulnerable Excel/Office build - the CVSS UI:R and AV:L metrics confirm local vector plus mandatory user interaction, so this cannot be triggered remotely without victim action. Limiting factors: the attacker gains only the current user's privileges (S:U, PR:N means no pre-existing privileges needed but also no privilege escalation), Microsoft's Protected View/Mark-of-the-Web sandbox will open untrusted files in read-only mode and must be bypassed or dismissed by the user for code execution, and the target must be running an unpatched affected version across Windows, Mac, or Office Online Server. |
| Impact | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning code execution is local, low-complexity, requires no privileges but does require user interaction (opening a file), with full CIA impact in the user's context. This is a typical 'open-a-document' Office bug: dangerous because phishing makes user interaction trivial to obtain, but bounded because it does not self-propagate and yields only user-level, not SYSTEM, privileges. No EPSS score, POC indicator, or SSVC decision data was provided, and the vulnerability is not in CISA KEV, so there is no evidence of active or automatable exploitation at this time. Net assessment: a genuine but standard-priority Patch-Tuesday-class issue - prioritize patching given Office ubiquity and the ease of phishing delivery, but absent KEV/POC/EPSS signals it is not an emergency drop-everything item. |
| Exploit ScenarioDerived | An attacker emails a crafted .xlsx/.xls spreadsheet (or hosts it for download) to a target and uses social engineering to get the victim to open it in a vulnerable Excel/Office build. Parsing the malformed data overflows a stack buffer and executes attacker code in the user's context, giving the attacker a foothold for credential theft or lateral movement. No public exploit is identified at time of analysis, and successful exploitation depends on the user bypassing Protected View. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Local code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from a stack-based buffer overflow (CWE-121) triggered when a user opens a maliciously crafted spreadsheet. An attacker who convinces a victim to open the file runs arbitrary code in the security context of the current user, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; Microsoft has released a patch.
RemediationAI
Patch available per vendor advisory - apply Microsoft's security update for each affected channel via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55899, ensuring Click-to-Run/Microsoft 365 Apps auto-update is enabled and that LTSC/MSI builds, Office for Mac, and Office Online Server all receive their respective updates (exact patched build numbers are listed in the advisory and were not provided here). Until patching completes, compensating controls include enabling Protected View and blocking Office files from the internet/email so they open sandboxed (side effect: users must manually enable editing for legitimate files), configuring the 'Block macros/untrusted documents' and Attack Surface Reduction rules, and using Mark-of-the-Web enforcement; for Office Online Server, restrict who can upload/open untrusted spreadsheets. These controls reduce but do not eliminate risk since the overflow is in file parsing, so patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-121) in Excel's spreadsheet file-parsing code, where a fixed-size stack buffer is overrun by attacker-controlled data embedded in a crafted document, corrupting the return address or adjacent stack structures and redirecting execution. The CPE data shows this is not isolated to the standalone Excel client but spans the shared Office parsing components across cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, their macOS equivalents (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021/2024), and the server-side office_online_server. Because the vulnerable parser is common to both Windows and Mac builds and to the browser-based Office Online Server, the same malformed-input handling defect is reachable across multiple deployment models.
Know when Office Online Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user (AV:L, UI:R); no prior privileges needed (PR:N); memory-corruption code execution yields full user-context CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Executive ViewAI
CVE-2026-55899 poses a high-risk endpoint threat to Microsoft Excel and Office environments (365, 2019, 2021, 2024, Mac, and Online Server), enabling code execution through maliciously crafted spreadsheets distributed via email or file sharing. This attack vector particularly threatens knowledge-worker populations, where file-based collaboration and social engineering create direct exposure. Timely patching is essential to prevent data compromise and operational disruption across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Exploit-DB