Microsoft Excel CVE-2026-55947

Exploitation requires a victim to open an attacker-crafted Excel file in a vulnerable build - the CVSS vector's UI:R confirms mandatory user interaction, which is the primary limiting factor. PR:N means no authentication or prior privileges on the target are needed, and AC:L means no special timing or race conditions apply. The AV:L (local) rating reflects that the malicious file must be delivered to and opened on the target host rather than exploited over a network; there is no remote unauthenticated network path. Protected View (Office's default sandbox for files from the internet/email) further limits exploitation, since the user must click 'Enable Editing' to leave the sandbox before the vulnerable parsing path is reached in the fully privileged context. Affected configurations are default installations of the listed Office editions; no non-default feature toggle is required beyond the user opening the document.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Despite the AV:L (Local) attack vector, this is the standard client-side file-open pattern: the attacker cannot reach the target over a network, so a user must open a malicious file (UI:R), but no prior privileges are needed (PR:N) and complexity is low (AC:L). Impact is high across confidentiality, integrity, and availability, all confined to the user's own security context (S:U). No EPSS score, SSVC decision, or POC indicator was supplied, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation - the practical risk hinges on social engineering to get a victim to open the file. This profile is typical of Patch-Tuesday Office memory-corruption bugs: genuinely exploitable and worth prompt patching given Excel's ubiquity, but dependent on user interaction rather than a wormable remote hole. Note: EPSS and POC data are absent from the input and should be verified before final prioritization.

An attacker crafts a malicious Excel workbook whose internal records overflow a heap buffer during parsing and emails or shares it (e.g., as an invoice or report) with a target. When the victim opens the file in a vulnerable Excel build outside Protected View, the overflow executes attacker-supplied code in the user's context. No public proof-of-concept was identified at time of analysis, and the local vector plus required user interaction mean success depends on social engineering.