Microsoft Excel CVE-2026-56156

Exploitation requires the victim to open an attacker-crafted Excel spreadsheet file in a vulnerable Office build (UI:R user interaction is mandatory per the CVSS vector), on any of the affected Windows or macOS Office SKUs. The local attack vector (AV:L) means the malicious file must be delivered to and processed on the target machine - via email attachment, download, or share - rather than exploited remotely over the network. No authentication or pre-existing privileges are needed (PR:N), and code runs in the context of the opening user. What limits exploitation: the hard dependency on user interaction (opening the file, and defeating Protected View if enabled), the lack of any confirmed public exploit or active exploitation, and that impact is confined to the current user (S:U, no privilege escalation implied).

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local attack vector requiring user interaction (opening a crafted file) but no prior authentication or privileges, yielding full impact within the user's context. This is a classic client-side file-format vulnerability: high impact if triggered, but gated by the requirement that a victim open attacker-supplied content, which lowers real-world exploitability compared to a network-facing unauthenticated bug. No EPSS score, SSVC decision, POC, or KEV listing was provided, so exploitation is not confirmed or automatable; there is no public exploit identified at time of analysis. The realistic priority is moderate-to-high driven by prevalence rather than exploitation certainty - Office is ubiquitous and Excel bugs are historically phishing-attractive, so this warrants prompt patching even though it is not a drop-everything network worm.

An attacker emails or shares a specially crafted Excel spreadsheet - for example as a phishing attachment or a link to a document - and a user opens it in a vulnerable Office/Excel build. Excel's parser overflows a heap buffer while processing the malformed content, allowing the attacker's shellcode to run with the victim user's privileges. No public exploit is identified at time of analysis, so this reflects a plausible rather than observed attack.