EUVD-2026-56453
GHSA-qjh2-cff4-qrcf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open trigger with no attacker privileges required; user must open the file; full CIA impact once exploited.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a maliciously crafted file. The vulnerability (CWE-122) corrupts heap memory in Excel's parsing logic, allowing an attacker to achieve full control over confidentiality, integrity, and availability of the affected system. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 7.8 with high impact across all three CIA triad pillars makes this a meaningful priority for organizations running affected Excel versions.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) arises when data written to a heap-allocated buffer exceeds its allocated bounds, corrupting adjacent heap metadata or object pointers. In the context of Microsoft Office Excel, this class of vulnerability is typically triggered during the parsing of document structures - such as record types, formula tokens, or embedded objects - where insufficient bounds checking allows attacker-controlled input to overwrite heap memory. Successful exploitation typically requires control over memory layout to redirect execution flow to attacker-controlled shellcode or ROP chains. The CVSS vector AV:L reflects that the exploit is triggered locally (e.g., via file open), consistent with document-parsing vulnerabilities. No specific CPE strings were provided in the input, so exact affected build numbers are not independently confirmable beyond the MSRC advisory reference.
RemediationAI
Apply the patch released by Microsoft via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68794. No specific fixed version number was included in the provided data, so the exact remediated build must be confirmed directly from the MSRC page. Until patching is complete, consider disabling automatic opening of Excel attachments in email clients and enforcing Protected View for files originating from external sources - Excel's Protected View mode sandboxes document parsing and can prevent code execution even if exploitation is triggered. Organizations can also restrict macro execution and use Microsoft Defender Application Guard for Office to isolate document processing. Note that Protected View can be bypassed by users who click through warnings, so user awareness training should accompany any compensating control.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today