EUVD-2026-56445
GHSA-6cm4-q5j4-r599
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network delivery via malicious file requires user to open it (UI:R); no attacker privileges needed; full RCE yields complete C/I/A compromise of the Excel process.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
AnalysisAI
Type confusion in Microsoft Office Excel's file-processing engine enables remote code execution when a user opens a specially crafted spreadsheet document. The vulnerability carries a CVSS 8.8 High score with full confidentiality, integrity, and availability impact against the Excel process, requiring only user interaction to trigger - the classic phishing-attachment threat model. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
The root cause is CWE-843 (Type Confusion), a memory-safety vulnerability class in which code accesses a resource using an incompatible type assumption - for example, treating a pointer to one object class as a pointer to another. In Excel, this likely manifests during parsing or processing of spreadsheet file structures (XLS, XLSX, or embedded object model data), where attacker-controlled document content causes the parser to misidentify a data type. Type confusion vulnerabilities commonly provide controlled read/write memory primitives that can be chained into arbitrary code execution. The 'Memory Corruption' tag in the intelligence data is consistent with this exploitation pathway. The authoritative source for affected CPE strings and exact product versions is the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65807.
RemediationAI
Apply the Microsoft security update for CVE-2026-65807 via Windows Update or the Microsoft Update Catalog; the exact patched build version must be obtained from the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65807, as a specific fix version was not confirmed in the available input data. As an interim compensating control, ensure Excel's Protected View is enforced for files originating from the internet and email attachments (enabled by default but sometimes disabled by policy), which adds a read-only sandbox barrier before editing is permitted - this reduces but does not eliminate risk, as users may manually enable editing. Additionally, enforce Microsoft Defender Attack Surface Reduction (ASR) rule 'Block Office applications from creating child processes' (GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a), which limits post-exploitation impact at the cost of potentially breaking macros or add-ins that spawn child processes. Blocking execution of Office files from untrusted network locations via AppLocker or WDAC provides additional depth.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today