EUVD-2026-44231
GHSA-g26f-g9f2-wqvr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no attacker privileges (PR:N); memory-corruption code execution yields full C:H/I:H/A:H in the user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) allows an attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted spreadsheet. The flaw stems from use of an uninitialized resource (CWE-908) and carries a CVSS 7.8; it requires user interaction (opening the file) and no prior privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Technical ContextAI
The affected technology is Microsoft's Excel spreadsheet parsing/rendering engine, shared across the Office family (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office 365 for Mac, Office LTSC 2021/2024 on Windows and Mac, and Office Online Server) as identified by the provided CPE strings. The root cause is CWE-908, Use of Uninitialized Resource: Excel reads a memory buffer, object, or variable before it has been initialized with a defined value. When a crafted file supplies data that steers the uninitialized value, the resulting undefined state can be leveraged to corrupt memory or redirect control flow, enabling arbitrary code execution in the process context of the user who opened the document.
RemediationAI
Apply the Microsoft-released security update as the primary fix: consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55949 for the exact patched build for each affected SKU (Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server), since the input confirms a patch is available but does not list specific version numbers. For click-to-run Microsoft 365 installations, ensure automatic updates are enabled so the current channel build is deployed. Until patching completes, compensating controls include opening untrusted spreadsheets in Protected View (do not disable it), blocking or quarantining Excel attachments from external email, and using Attack Surface Reduction rules and Office macro/file-blocking policies to restrict opening of files from the internet; the trade-off is reduced convenience for users who legitimately exchange external spreadsheets. Do not rely on these workarounds long-term, as the underlying uninitialized-resource flaw remains until the update is installed.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today