What is the CVSS score of CVE-2026-68805?

CVE-2026-68805 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Excel are affected by CVE-2026-68805?

Microsoft Office Excel contains a heap-based buffer overflow vulnerability (CVE-2026-68805) that enables complete system compromise when users open specially crafted files.. A patch is available.

How to fix or mitigate CVE-2026-68805?

Within 24 hours, issue urgent security communication to all staff warning against opening Excel files from untrusted sources and disable macros in Excel application settings. Within 7 days, complete an audit of Excel file handling practices across the organization, implement endpoint file scanning for all Excel documents, and deploy endpoint detection/response (EDR) tooling to monitor for suspicious Excel process behavior. Within 30 days, institute mandatory security awareness training focused on malicious document vectors, implement application whitelisting policies for Office products to restrict process execution, and evaluate secure document review solutions that can safely preview Excel files in isolated environments.

Microsoft Excel CVE-2026-68805

EUVD-2026-56759 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-hv7j-5cx9-87r4

Buffer Overflow Heap Overflow Microsoft 365 Apps Excel Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-borne attack requires no system privileges (PR:N) but mandates user opens the file (UI:R, AV:L); successful heap overflow yields full code execution impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:05 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The CVSS vector (AV:L/PR:N/UI:R) confirms the attack requires no system privileges but does require user interaction - the classic malicious-document delivery pattern. Full confidentiality, integrity, and availability compromise results, making this a high-severity threat against any organization reliant on Excel for document workflows. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) indicates the root cause is improper bounds checking during memory allocation or copy operations on the heap, likely within Excel's file parsing engine (e.g., XLS/XLSX format handlers). When Excel processes a maliciously structured workbook, attacker-controlled data overflows a heap buffer, corrupting adjacent heap metadata or function pointers. This class of vulnerability in Office document parsers is well-understood: heap grooming or use of modern heap exploitation techniques (e.g., LFH manipulation on Windows) can turn the overflow into reliable control-flow hijack. The local attack vector (AV:L) paired with user interaction (UI:R) places this squarely in the file-borne malware delivery model. No CPE strings were provided in the input; exact affected Excel versions must be confirmed via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68805.

RemediationAI

The primary remediation is to apply the vendor-supplied patch via Microsoft's standard update channels (Windows Update, Microsoft Update Catalog, or Microsoft 365 update mechanism). The exact patched version is not confirmed in the available data - consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68805 for the specific KB article and patched build numbers. Until patching is complete, apply Microsoft's Protected View feature in Office to open untrusted documents in a sandboxed read-only mode, which prevents code execution from maliciously crafted files in most scenarios (note: users may still click to enable editing, bypassing this control). Additionally, enforcing Attack Surface Reduction (ASR) rule 'Block Office applications from creating executable content' via Microsoft Defender for Endpoint adds a compensating layer. Email gateway filtering of Office attachments from untrusted senders reduces delivery surface, though it does not eliminate web-download or USB-based delivery paths.