Microsoft Excel CVE-2026-55949

Exploitation requires a victim to open an attacker-crafted Excel file on an affected Office installation, as reflected by UI:R (required user interaction) and AV:L (local file-based vector) in the CVSS vector; the attacker needs no pre-existing privileges (PR:N) on the target. Limiting factors: the malicious spreadsheet must be delivered and actually opened by the user, and Microsoft's Protected View (the default sandbox for files from the internet/email) must be bypassed or dismissed for the payload to reach the vulnerable code path with full rendering. Code executes only in the context of the user who opens the file, not with elevated privileges. This is not a remote, zero-click, or unauthenticated-network vulnerability despite the 'Authentication Bypass' tag in the source data, which is inconsistent with the CWE-908 description and unverified.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High), driven by high confidentiality, integrity, and availability impact. The vector is Local (AV:L) with Required user interaction (UI:R) - meaning exploitation depends on a victim opening a malicious file, not remote unauthenticated access; the PR:N indicates the attacker themselves needs no privileges. No EPSS score, SSVC decision, KEV entry, or POC was provided, so real-world exploitation likelihood cannot be quantified from the input. This profile is typical of file-format 'open a document' bugs: dangerous where users routinely open untrusted spreadsheets (email attachments, downloads), but gated by the social-engineering step. Absent KEV listing or a public POC, this is a standard high-priority patch-cycle item rather than an emergency, though Excel's ubiquity warrants prompt patching. Note: PR:N combined with UI:R means the impact falls on the victim's account context; the 'Authentication Bypass' tag in the input is not corroborated by the description or CWE and should be treated with skepticism.

An attacker emails a finance employee a crafted .xlsx spreadsheet disguised as an invoice or report; when the victim opens it and exits Protected View, Excel processes the malformed structure, triggers the uninitialized-resource condition, and executes attacker-supplied code with the victim's privileges. Because the CVSS vector is AV:L with UI:R, the attack hinges on convincing the user to open the file rather than on any network exposure. No public exploit is identified at time of analysis.