EUVD-2026-43774
GHSA-cjqx-7vg8-mm6c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Code executes locally only when a user opens a crafted file, so AV:L and UI:R; no attacker privileges (PR:N) and full RCE in user context gives C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local arbitrary code execution in Microsoft Excel arises from a heap-based buffer overflow (CWE-122) triggered when a user opens a maliciously crafted spreadsheet; successful exploitation runs attacker code in the context of the current user across desktop Office builds (Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps) on both Windows and Mac, as well as Office Online Server. The flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact but requires user interaction (opening the file). No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available from Microsoft.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-122) in the file-parsing logic of Microsoft Excel, the spreadsheet component of the Microsoft Office suite. Heap overflows occur when code writes more data into a dynamically allocated buffer than it can hold, corrupting adjacent heap structures (allocation metadata, object pointers, or function pointers) that an attacker can groom to redirect execution. In office-document parsers this class of bug is typically reached through malformed records or length fields inside a crafted workbook that the parser trusts without adequate bounds checking. The affected CPE set spans microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_office_ltsc_for_mac_2021/2024, and office_online_server - indicating the vulnerable code lives in shared Excel/Office parsing components common to Windows, macOS, and server-side rendering deployments.
RemediationAI
Patch available per vendor advisory: apply the Microsoft update for CVE-2026-58618 documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58618, which covers Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021/2024, the Mac builds, and Office Online Server (exact patched build numbers per channel are listed in the MSRC guide and are not reproduced in the input, so verify the target build there rather than assuming a version). For endpoints that cannot be patched immediately, reduce exposure by enabling Protected View / Office hardening so files from the internet and email attachments open in a sandboxed read-only mode (trade-off: users must click to enable editing, adding friction), blocking or quarantining Excel attachments (.xls/.xlsx/.xlsm) at the mail gateway from untrusted senders (trade-off: may delay legitimate business documents), and enabling Attack Surface Reduction rules for Office child-process creation on Windows. These are compensating controls only; the definitive fix is the vendor update.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today