Microsoft Excel CVE-2026-55948

Exploitation requires the victim to open an attacker-supplied malicious Excel workbook in a vulnerable build (UI:R) - the user interaction of opening the file is the mandatory trigger, and the attack is local (AV:L), not remotely exploitable over the network. No prior authentication or privileges on the target are needed (PR:N), and code executes only in the context of the user who opens the file (S:U, so no privilege escalation is granted by the bug itself). Limiting factors: Protected View / Mark-of-the-Web sandboxing on internet-downloaded files, mail-gateway attachment filtering, and the need for social engineering to induce the open all reduce real-world exploitability. For Office Online Server, the condition is server-side rendering of an attacker-controlled document.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high impact to confidentiality, integrity, and availability but constrained by a local attack vector and required user interaction - the 'local' vector here means the malicious file must be opened on the target, typically via phishing rather than remote network exploitation. There is no CISA KEV listing and no EPSS score supplied, and no public exploit identified at time of analysis, so this is not confirmed as actively exploited. PR:N indicates no pre-existing privileges are needed, but UI:R (opening a document) is the real gating factor and meaningfully lowers automated/wormable risk. Priority is moderate-to-high for environments with broad Office deployment and phishing exposure, but this is not a drive-by remote-code-execution emergency; missing EPSS and the absence of KEV/POC signals mean urgency is driven by product ubiquity, not confirmed in-the-wild activity.

An attacker emails a victim a crafted .xlsx/.xls spreadsheet (or hosts it on a shared/SharePoint location); when the user opens it in a vulnerable Excel build, the malformed structure triggers the use-after-free and executes attacker code with the user's privileges. Because the attack requires opening the file (UI:R) and runs locally, delivery is typically via phishing or a watering-hole document. No public exploit is identified at time of analysis, so weaponization difficulty is currently unknown.