Microsoft Excel CVE-2026-70254

Exploitation requires the victim to open an attacker-crafted Excel document in Microsoft Office (UI:R in the CVSS vector) - it is NOT a zero-click or server-side flaw. No authentication or prior access is needed (PR:N), and attack complexity is low (AC:L), but the mandatory user-interaction step and lack of automatability (SSVC Automatable: no) are the primary limiting factors. Affected configurations per EUVD include Microsoft Office LTSC 2021 (below 16.0.14334.20974), Office LTSC 2024 (below 16.0.17932.21056), Microsoft 365 Apps for Enterprise, and Office 365 for Mac; code executes in the security context of the user opening the file, so least-privilege user accounts reduce blast radius.

This is a credible high-priority patch target but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-delivered, unauthenticated, low-complexity attack that nonetheless requires user interaction - the victim must open a malicious Excel document, which materially lowers real-world likelihood versus a zero-click flaw. CISA's SSVC framework reinforces a measured posture: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (user interaction prevents reliable mass automation), while Technical Impact is 'total' (consistent with the C:H/I:H/A:H code-execution outcome). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'high CVSS driven by impact, not by demonstrated exploitation.' No EPSS score was provided in the input, so exploitation probability cannot be quantified here. One internal tension worth verifying: the Tags label this 'Information Disclosure' and CWE-125 is an out-of-bounds READ, yet the description and impact metrics assert full code execution - out-of-bounds reads more typically yield memory disclosure than direct RCE, so Microsoft's RCE characterization should be taken as authoritative over the generic tag.

An attacker emails or hosts a specially crafted Excel spreadsheet (e.g., via phishing or a watering-hole download) and lures a user into opening it. When Excel parses the malformed structure, an out-of-bounds read is triggered that the attacker leverages to execute arbitrary code in the context of the current user. No public proof-of-concept or exploit code has been identified at time of analysis.