Microsoft Excel CVE-2026-58618

Exploitation requires a victim to open a specially crafted Excel workbook (UI:R in the CVSS vector) - the attacker cannot trigger the overflow without that user action. No prior authentication or privileges on the target are needed (PR:N), and the code executes with the opening user's rights. Limiting factors that reduce realistic risk: the mandatory user interaction of opening the file, the fact that Office Protected View / Mark-of-the-Web opens internet-sourced files in a sandbox by default (forcing the user to explicitly click 'Enable Editing' before the vulnerable parsing path is fully reached in many configurations), and that impact is confined to the current user context (S:U, no privilege escalation). Affected only where a vulnerable Excel/Office build is installed (Office 2016 through LTSC 2024, Microsoft 365 Apps, the Mac builds, or Office Online Server).

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High): the local attack vector combined with required user interaction reflects the classic 'victim opens a malicious file' pattern rather than remote unauthenticated compromise - PR:N means no attacker privileges are needed, but UI:R means an authorized user must be socially engineered into opening the document. No EPSS score was provided, so exploitation probability cannot be quantified from the input. The vulnerability is NOT in CISA KEV and no POC or public exploit was referenced, so there is no evidence of active exploitation - this is a normal-cycle patch priority rather than an emergency, though Excel's enormous install base and the reliability of heap-overflow-to-RCE techniques in Office make it a worthwhile target for phishing once analysts reverse the patch. One nuance to verify: the vector uses AV:L while realistic delivery is a document arriving over email/network; this is expected Office scoring (the exploit executes locally when the file is opened) and should not be read as requiring pre-existing local access. Missing signals: no EPSS, no SSVC decision, and no independent POC confirmation.

An attacker crafts a malicious Excel workbook whose internal records trigger the heap overflow and emails it as a phishing lure (e.g., a fake invoice or report) to a target user. When the victim opens the file - and, if prompted, dismisses Protected View - the overflow corrupts the heap and executes attacker-controlled code with the user's privileges, giving a foothold for further actions. No public exploit is currently identified, but the required user interaction is low-friction and well within reach of standard social-engineering campaigns.