Microsoft Excel CVE-2026-81401

The victim must open a specially crafted Excel workbook on a local system running a vulnerable Office build. No authentication or elevated privileges are required of the attacker, but the attacker must deliver the malicious file to the victim and the victim must actively open it (UI:R). The attack vector is local (AV:L), meaning the malicious document must already be present on or delivered to the target's filesystem - this rules out fully remote exploitation without a social engineering or delivery step. Protected View (default for externally-sourced files in enterprise Office configurations) would limit exploitation unless the user clicks 'Enable Editing'. Mac Office variants are affected but specific minimum-fix builds were not enumerated in the advisory data for those platforms.

Real-world risk is moderate. The CVSS 5.5 is consistent with the local/user-interaction model: an attacker cannot exploit this remotely without first delivering a malicious file and convincing a user to open it (UI:R). The High confidentiality impact (C:H) is notable - type confusion in a spreadsheet parser could expose sensitive heap contents, potentially including in-memory credentials, document data, or pointer values useful for further exploitation. However, several factors temper urgency: SSVC rates exploitation as 'none' and automatable as 'no', no public exploit or CISA KEV listing exists, and SSVC technical impact is only 'partial'. The combination of AV:L and UI:R significantly raises the bar for mass exploitation - this is not a drive-by network attack. The wide install base of Microsoft 365 and Office LTSC across enterprises makes patching important, but the absence of any exploitation signal and the phishing-dependent delivery model reduce immediate urgency below pure CVSS-score comparison would suggest.

An attacker crafts a malicious Excel file containing a specially structured record or formula designed to trigger the type confusion in the spreadsheet parser. The file is delivered via email, Teams message, or shared drive. When the victim opens the file in a vulnerable version of Excel, the parser reads memory using an incompatible type, leaking heap contents - potentially including sensitive in-memory data such as document content from other open files, pointer values, or authentication material - back to the attacker through a controlled output channel embedded in the workbook. No public exploit code has been identified at time of analysis.