EUVD-2026-44232
GHSA-4v4x-hh7w-55p3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based client exploit: local vector and required user interaction to open the crafted spreadsheet, no privileges needed, full code-execution impact in the user's context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel (across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS counterparts) arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted spreadsheet. An unauthorized attacker can achieve arbitrary code execution in the context of the current user, gaining high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available from Microsoft.
Technical ContextAI
The flaw is a heap-based buffer overflow (CWE-122) in Excel's parsing of spreadsheet file content. This class of bug occurs when data written to a dynamically allocated heap buffer exceeds its bounds, corrupting adjacent heap metadata or object pointers, which an attacker can groom to hijack control flow and execute code. The affected surface spans Microsoft's Office file-parsing engine as shipped in Microsoft 365 Apps for Enterprise (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise), Office 365 for Mac, Office LTSC 2021 and 2024, and Office LTSC for Mac 2021 and 2024 - indicating the vulnerable code is common to both Windows and macOS Office builds. Because Office documents are a routine delivery vector, malformed content in the workbook stream is processed at open time before the user takes any explicit action beyond opening the file.
RemediationAI
Apply the Microsoft update for CVE-2026-56156 per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56156; patch status is Patch available per vendor advisory, though an exact fixed build number was not included in the input and should be taken from that advisory for each affected channel (Microsoft 365 Apps, Office LTSC 2021/2024, and the macOS equivalents). For endpoints that cannot be immediately updated, reduce exposure by enabling Protected View and Office block-macros/attachment policies so untrusted spreadsheets open in a sandboxed, read-only state (trade-off: users must click to enable editing, which can hamper legitimate workflows), and block or quarantine inbound Excel attachments from untrusted sources at the mail gateway (trade-off: may delay legitimate documents). Because delivery relies on the user opening a file, user awareness training against opening unsolicited spreadsheets is a meaningful compensating control until patching completes.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today