Microsoft Excel CVE-2026-81954

The victim must open a specially crafted Excel workbook file using a vulnerable version of Microsoft Excel on Windows or macOS. No system-level privileges or credentials are required of the attacker, but user interaction (UI:R) is mandatory - the attack cannot execute without the victim actively opening the malicious document. The file can be delivered over any channel (email attachment, web download, shared drive). Exploitation is limited by the need to bypass modern mitigations such as Protected View, which prompts users before enabling full edit mode on externally sourced documents; if Protected View is active and the user does not click 'Enable Editing', the attack surface is significantly reduced. The vulnerability is present in all listed Office version lines on both Windows and Mac platforms.

CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly reflects the file-based delivery model: an attacker need not hold any system account privileges, but the victim must actively open a malicious Excel document, capping the attack complexity at AC:L once delivery is achieved. The full CIA triad impact at High severity indicates potential for arbitrary code execution within the victim's session. No EPSS score was provided, and the CVE is not listed in CISA KEV, so actual in-the-wild exploitation cannot be confirmed from the available data. No public proof-of-concept has been identified at the time of analysis. Despite the absence of a known public exploit, the extremely broad deployment footprint of Microsoft Office - used daily across virtually every enterprise, government, and education sector - means that even a mid-sized IT organization with routine patch latency faces meaningful residual risk until updates are applied. The attack complexity is low once a weaponized file is delivered, making it a practical target for spear-phishing or malicious document campaigns if exploit code is developed.

An attacker crafts a malicious Excel workbook that triggers a use-after-free condition during file parsing - for example, embedding a construct that causes Excel to free an internal object but retain a pointer used in a subsequent formula evaluation step. The attacker delivers the file via a phishing email or a compromised file-sharing link. When the victim opens the file in a vulnerable version of Excel, the UAF is triggered, corrupting heap memory in a controlled manner that redirects execution to attacker-supplied shellcode, yielding a shell or implant at the victim's privilege level. No public proof-of-concept is identified at time of analysis.