Microsoft Office Excel CVE-2026-81947

The victim must open a specially crafted Excel file using an affected version of Microsoft Excel. No authentication to a remote system is required by the attacker - the attack is entirely file-delivery and social-engineering based. The CVSS UI:R metric confirms that user interaction (opening the file) is mandatory; there is no known remote or zero-click vector. No non-default configuration is required - the vulnerable code path is in the standard Excel file parser, active in default installations. Exploitation is limited to the victim's local privilege level (S:U, scope unchanged), meaning the attacker cannot directly escalate to SYSTEM or kernel without a separate privilege-escalation step. Protected View, if enabled and respected by the user, adds a one-step barrier but does not eliminate the vulnerability.

CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly reflects the local-execution-via-malicious-file model. The AV:L designation does not imply physical access - it means the exploit runs on the victim's local machine after they open the file, a distinction important for prioritization. AC:L and PR:N indicate no special configuration or system privileges are required on the attacker side; the only gate is user interaction (UI:R). No EPSS data was supplied, KEV status is absent, and no public POC has been identified, making this a patch-prioritization-level finding rather than an emergency-response-level one. The real-world risk is meaningful given the extreme prevalence of Excel across enterprise environments and the low social-engineering bar for delivering malicious documents via email or web download. The scope of affected versions (six distinct release lines including current M365 Apps) amplifies exposure. Missing: EPSS score and POC status are not confirmed from supplied data.

An attacker crafts a malicious Excel workbook (.xlsx or .xls) embedding a specially structured record designed to trigger the heap overflow in Excel's parser. The file is delivered to a target via a phishing email or compromised website download. When the victim opens the file in an affected Excel version, the parser overflows the heap buffer, corrupting adjacent memory and redirecting execution to attacker-controlled shellcode, resulting in arbitrary code execution under the user's account.