EUVD-2026-44041
GHSA-vm8w-v83h-8752
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally so AV:L and UI:R; no prior privileges needed (PR:N); code runs as the user granting full C/I/A impact within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption (CWE-416) that an attacker triggers when a victim opens a maliciously crafted spreadsheet. Exploitation runs code in the context of the current user and requires user interaction (opening the file), with no public exploit identified at time of analysis. This is a locally-exploited, phishing-delivered class of bug typical of Office file-format handlers, patched by Microsoft via MSRC.
Technical ContextAI
The flaw is a use-after-free (CWE-416) in the Excel file-parsing/rendering engine: the application frees a heap object but retains and later dereferences a dangling pointer, allowing an attacker who controls the object's memory layout via a crafted workbook to corrupt the heap and redirect execution. The CPE set confirms the affected surface spans the shared Office codebase - Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, Office 365/LTSC for Mac 2021/2024, and Office Online Server - indicating the vulnerable component is in the common Excel document-processing library rather than a platform-specific feature. Use-after-free bugs in Office are a recurring root cause because complex, legacy binary and OOXML formats create many object-lifetime edge cases during parsing.
RemediationAI
Patch available per vendor advisory: apply Microsoft's security update for CVE-2026-55948 across all affected Office channels via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55948 (exact fixed build numbers are not specified in the provided data - retrieve them from the advisory for each channel such as Current Channel, Monthly Enterprise Channel, and LTSC). Until patching completes, reduce exposure by blocking or quarantining Excel attachments from untrusted senders at the mail gateway, enabling Protected View and Block macros/Office file-blocking policies to force sandboxed opening of internet-sourced workbooks (trade-off: users must explicitly enable editing, adding friction), and restricting Office Online Server document rendering to trusted sources. Attack Surface Reduction rules and opening untrusted spreadsheets in Excel for the web or a sandbox further limit impact; none of these fully remove the vulnerability, so patching remains the primary fix.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today