EUVD-2026-44040
GHSA-hr7p-25v4-pxc7
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user (AV:L, UI:R); no prior privileges needed (PR:N); memory-corruption code execution yields full user-context CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from a stack-based buffer overflow (CWE-121) triggered when a user opens a maliciously crafted spreadsheet. An attacker who convinces a victim to open the file runs arbitrary code in the security context of the current user, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; Microsoft has released a patch.
Technical ContextAI
The flaw is a classic stack-based buffer overflow (CWE-121) in Excel's spreadsheet file-parsing code, where a fixed-size stack buffer is overrun by attacker-controlled data embedded in a crafted document, corrupting the return address or adjacent stack structures and redirecting execution. The CPE data shows this is not isolated to the standalone Excel client but spans the shared Office parsing components across cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, their macOS equivalents (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021/2024), and the server-side office_online_server. Because the vulnerable parser is common to both Windows and Mac builds and to the browser-based Office Online Server, the same malformed-input handling defect is reachable across multiple deployment models.
RemediationAI
Patch available per vendor advisory - apply Microsoft's security update for each affected channel via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55899, ensuring Click-to-Run/Microsoft 365 Apps auto-update is enabled and that LTSC/MSI builds, Office for Mac, and Office Online Server all receive their respective updates (exact patched build numbers are listed in the advisory and were not provided here). Until patching completes, compensating controls include enabling Protected View and blocking Office files from the internet/email so they open sandboxed (side effect: users must manually enable editing for legitimate files), configuring the 'Block macros/untrusted documents' and Attack Surface Reduction rules, and using Mark-of-the-Web enforcement; for Office Online Server, restrict who can upload/open untrusted spreadsheets. These controls reduce but do not eliminate risk since the overflow is in file parsing, so patching remains the definitive fix.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today