EUVD-2026-56756
GHSA-cff6-wjc9-gpcj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L and UI:R reflect file-open trigger; PR:N because attacker controls only the delivered document; full CIA for arbitrary local code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted workbook, resulting in full compromise of confidentiality, integrity, and availability on the local system. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no attacker privileges are required, though user interaction - opening the malicious file - is a hard prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is confirmed by Microsoft's Security Response Center via secure@microsoft.com.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) identifies the root cause: Excel's file parsing logic fails to properly bound-check memory allocations when processing a crafted workbook, allowing an attacker to overwrite adjacent heap memory. In practice, heap overflows in document parsers enable corruption of heap metadata, vtable pointers, or function pointers, redirecting execution to attacker-controlled code. The attack vector is local (AV:L), consistent with the overflow being triggered during in-process file parsing rather than over the network. No CPE strings were included in the available data, so the exact affected product version and platform cannot be pinned from this source alone; the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68801 is the authoritative reference for version scope. Modern Windows heap hardening (ASLR, heap segment randomization, guard pages) would need to be bypassed for reliable exploitation.
RemediationAI
Apply the Microsoft security update for Office Excel published via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68801; no exact fixed version number was present in the available intelligence, so the advisory must be consulted directly to identify the required update package and confirm applicability to your Office version. As a compensating control before patching, ensure Office Protected View is enabled for files originating from the internet or email attachments - this opens untrusted workbooks in a sandboxed read-only mode that can prevent the parsing code path triggering the overflow from being exercised, though users who click 'Enable Editing' bypass this protection. Deploying the Attack Surface Reduction rule 'Block Office applications from creating child processes' (GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a) limits post-exploitation lateral movement but does not prevent the initial overflow. Mail-flow policies that strip or quarantine Excel attachments from external senders provide a delivery-layer defense with moderate operational impact in document-heavy environments.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today