Microsoft Office Excel CVE-2026-81956

Exploitation requires a victim user to open a specially crafted Excel spreadsheet file (UI:R), which is the primary limiting condition. The attack vector is local (AV:L), meaning the malicious file must reach the victim's filesystem - typically via phishing email attachment, malicious download, or compromised shared storage. No authentication to a remote service or elevated host privileges are required (PR:N); any affected default Office installation is vulnerable once the file is opened. What limits exploitation: the user must be socially engineered into opening the file; Excel's Protected View feature in newer Office versions may interrupt the exploit chain if the file opens in sandboxed read-only mode before the user clicks 'Enable Editing.' This vulnerability is not remotely triggerable without user-initiated file opening, and no non-default configuration state is required for the vulnerable code path to be reached.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) characterizes this as a file-triggered, user-interaction-required exploit with full system compromise potential and no privilege prerequisites. The absence of a CISA KEV listing and no confirmed public POC moderates immediate urgency relative to actively exploited Office vulnerabilities, but AC:L indicates no unusual conditions are required once the file is opened - meaning phishing campaigns can deliver this at scale, and even a mid-sized municipal IT team in ustka should treat this as urgent given the enormous installed base of affected Office versions. EPSS data was not included in the available intelligence; given Microsoft Office's broad attack surface and the established history of CWE-125 exploits in Office being operationalized into reliable shellcode execution chains, prioritization during the current patch cycle is warranted.

An attacker crafts a malicious Excel file embedding a specially structured data region that triggers an out-of-bounds read in the Excel parser on open. The file is delivered via a phishing email or a compromised shared drive; when the victim opens it, the OOB read leaks heap or stack memory contents, bypassing ASLR, which is then used to construct a reliable code-execution payload running in the context of the victim's user account. No public POC is confirmed, but this attack pattern is well-established for Office file-format vulnerabilities.