Microsoft Excel CVE-2026-81390

Exploitation requires that the victim opens a specially crafted Excel workbook using one of the affected Microsoft Office builds; the attack cannot be triggered remotely without this user action (UI:R). The CVSS vector AV:L/PR:N indicates that no authentication to the victim system is required of the attacker - only that the malicious file reaches the victim and is opened. Protected View may interrupt exploitation if the file is marked as downloaded from the internet, depending on whether the parser bug fires during protected rendering or only after full trust is granted. Both Windows and macOS Office variants are affected. Impact is strictly read-only memory disclosure; no integrity or availability primitive is present in the described vulnerability.

The CVSS 5.5 score accurately reflects the constrained threat model: AV:L requires a file to be opened on the local system, UI:R makes the attack non-automatable, and impact is C:H with I:N/A:N - pure memory disclosure with no write primitive. SSVC corroborates this, recording exploitation status as 'none' and automatable as 'no,' indicating no known active exploitation or scripted delivery tooling. The absence of a CISA KEV listing and no public exploit code further support a standard remediation cadence rather than emergency response. The chief residual risk is that a disclosed memory address could be chained into a higher-severity code execution primitive - a concern for targeted attacks against high-value individuals - but this scenario is speculative given current data. For organizations running unpatched builds, the practical limiting factor is that every exploitation attempt requires social engineering the victim into opening a file.

An attacker crafts a malicious Excel workbook that encodes an anomalous structure triggering the out-of-bounds read in Excel's parser, then delivers it to the target via phishing email or a compromised file share. When the victim opens the file, the parser reads memory outside its allocated buffer, potentially exposing heap addresses or in-process sensitive data to an attacker who can observe or receive the output. No public exploit code has been identified; practical exploitation requires tricking the victim into opening the file.