EUVD-2026-44231
GHSA-g26f-g9f2-wqvr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no attacker privileges (PR:N); memory-corruption code execution yields full C:H/I:H/A:H in the user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) allows an attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted spreadsheet. The flaw stems from use of an uninitialized resource (CWE-908) and carries a CVSS 7.8; it requires user interaction (opening the file) and no prior privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Technical ContextAI
The affected technology is Microsoft's Excel spreadsheet parsing/rendering engine, shared across the Office family (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office 365 for Mac, Office LTSC 2021/2024 on Windows and Mac, and Office Online Server) as identified by the provided CPE strings. The root cause is CWE-908, Use of Uninitialized Resource: Excel reads a memory buffer, object, or variable before it has been initialized with a defined value. When a crafted file supplies data that steers the uninitialized value, the resulting undefined state can be leveraged to corrupt memory or redirect control flow, enabling arbitrary code execution in the process context of the user who opened the document.
RemediationAI
Apply the Microsoft-released security update as the primary fix: consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55949 for the exact patched build for each affected SKU (Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server), since the input confirms a patch is available but does not list specific version numbers. For click-to-run Microsoft 365 installations, ensure automatic updates are enabled so the current channel build is deployed. Until patching completes, compensating controls include opening untrusted spreadsheets in Protected View (do not disable it), blocking or quarantining Excel attachments from external email, and using Attack Surface Reduction rules and Office macro/file-blocking policies to restrict opening of files from the internet; the trade-off is reduced convenience for users who legitimately exchange external spreadsheets. Do not rely on these workarounds long-term, as the underlying uninitialized-resource flaw remains until the update is installed.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today