What is the CVSS score of CVE-2026-68815?

CVE-2026-68815 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Excel are affected by CVE-2026-68815?

Microsoft Office Excel contains a vulnerability enabling local code execution (CVSS 7.8, CVE-2026-68815) when users open malicious files, exposing any organization with Excel deployments to system…. A patch is available.

How to fix or mitigate CVE-2026-68815?

Within 24 hours, conduct an inventory of all Excel installations across the enterprise, identify business-critical systems and users, and distribute security awareness communication warning employees against opening untrusted spreadsheet files from external sources. Within 7 days, deploy mitigating technical controls including disabling Excel 4.0 macros and VBA macro execution via Group Policy or Microsoft Intune, enabling Microsoft Defender Attack Surface Reduction rules for Office application processes, and restricting file transfer mechanisms including email and shared drive access for Excel documents. Within 30 days, establish patch management coordination with Microsoft, evaluate application control policies to restrict Excel execution to trusted paths, assess feasibility of transitioning non-critical workflows to alternative spreadsheet platforms, and implement user awareness training focused on social engineering tactics delivering malicious spreadsheets.

Microsoft Excel CVE-2026-68815

EUVD-2026-56465 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-9223-7x8q-h7rv

Buffer Overflow Heap Overflow Microsoft 365 Apps Excel Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-based local attack requires no attacker privileges (PR:N) but mandates user interaction (UI:R); full C/I/A impact reflects arbitrary code execution in user context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:01 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system-level impact when a victim opens a specially crafted Excel file. The flaw (CWE-122) resides in Excel's file parsing logic, where malformed input causes a heap memory region to be overwritten, redirecting execution flow. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA's Known Exploited Vulnerabilities catalog, though the Microsoft Security Response Center has issued an advisory.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) describes a class of memory corruption vulnerabilities where data written to a heap-allocated buffer exceeds its allocated bounds, overwriting adjacent heap metadata or data. In Excel's context, this typically occurs in file-format parsers handling complex binary or XML-based spreadsheet structures (XLS, XLSX, XLSM) where record sizes or field counts are not properly validated before copying into fixed-size heap buffers. The CVSS vector AV:L/AC:L/PR:N/UI:R confirms the attack surface is the local file-open operation - no network binding is involved. The attacker controls the malicious file structure to achieve controlled heap corruption, which can be leveraged for arbitrary code execution, commonly via heap-spray or return-oriented programming (ROP) techniques against modern mitigations. CPE data was not enumerated in the source intelligence; affected versions should be confirmed via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68815.

RemediationAI

Apply the Microsoft security update addressing CVE-2026-68815, available through the Microsoft Update Catalog and Windows Update via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68815. An exact patched build version was not independently confirmed from the available data - verify the specific KB article or update package version from the official advisory before deployment. As a compensating control prior to patching, enforce Excel's Protected View for files originating from the internet, email attachments, or untrusted locations via Group Policy (File Block settings under Office Trust Center), which prevents full file rendering and significantly raises the bar for exploitation. Disabling macros and ActiveX in Excel reduces adjacent attack surface. Mail gateway filtering of Excel file attachments (.xls, .xlsx, .xlsm, .xlsb) from untrusted external senders is an additional high-value control with potential operational trade-offs for organizations that routinely receive external spreadsheets.