What is the CVSS score of CVE-2026-68796?

CVE-2026-68796 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office Excel are affected by CVE-2026-68796?

A high-severity vulnerability in Microsoft Office Excel (CVE-2026-68796) allows attackers to execute arbitrary code on user systems through malicious spreadsheet files, affecting any organization…. A patch is available.

How to fix or mitigate CVE-2026-68796?

Within 24 hours, identify and inventory business-critical Excel users and workflows requiring immediate protective measures. Within 7 days, deploy interim mitigations including: disable Excel macro execution via Group Policy or Office configuration management (all supported versions), implement email gateway rules to block suspicious spreadsheet attachments based on file entropy and content inspection, and deliver targeted user security awareness training emphasizing file source verification. Within 30 days, establish a vendor monitoring cadence for CVE-2026-68796 patch releases, pre-stage patch deployment procedures and test them in a non-production environment, and evaluate application whitelisting or advanced threat protection solutions if available for your Office deployment model.

Microsoft Office Excel CVE-2026-68796

EUVD-2026-56455 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-3r5f-2f5q-hg58

Buffer Overflow Heap Overflow Microsoft 365 Apps Excel Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector because file must be opened on device; no attacker privileges needed; user interaction mandatory; full impact triad consistent with arbitrary code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:08 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. An unauthenticated attacker (per CVSS PR:N) delivers a malicious document that triggers the overflow upon interaction (UI:R), achieving full confidentiality, integrity, and availability compromise on the victim system. No public exploit or KEV listing has been identified at time of analysis, though the attack pattern is well-understood and document-based Excel exploits have a long operational history.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) describes the root cause: Excel's parsing code writes beyond an allocated heap buffer when processing a crafted file, corrupting adjacent heap metadata or data. This class of vulnerability in Office document parsers typically arises in format-specific parsers (XLS, XLSX, XLSB) that handle variable-length records without adequate bounds checking. The CVSS local attack vector (AV:L) confirms exploitation occurs on the local system, consistent with a file-open trigger rather than a network-reachable service. The affected CPE is inferred to be Microsoft Office Excel across versions addressed by the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68796.

RemediationAI

Apply the Microsoft security update addressing CVE-2026-68796 as documented in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68796. The exact patched build version is not confirmed in the available data - consult the advisory directly for the specific KB article and Office build number. As a compensating control pending patch deployment, configure email gateway and endpoint policies to block or sandbox unexpected Excel attachments (XLS, XLSX, XLSB, XLSM), and enable Microsoft Office Protected View and Attack Surface Reduction (ASR) rules that block Office applications from creating child processes. Note that Protected View can be bypassed by users who click 'Enable Editing', so it is a partial control. Mark-of-the-Web enforcement should also be verified so files downloaded from the internet open in Protected View by default.