Microsoft Excel CVE-2026-88151

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel file in Microsoft Office Excel (UI:R) - it is NOT triggerable against a default configuration without user action, and there is no passive/zero-click vector. No authentication is required (PR:N, unauthenticated) and the file can be delivered remotely over a network (AV:N), e.g. via email attachment or web download. The limiting factors defenders can rely on are: mandatory user interaction (opening the file, and typically dismissing Protected View / Mark-of-the-Web warnings), confidentiality-only impact (no integrity or availability loss, no code execution from this issue alone), and applicability only to the listed unpatched Office builds (Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise).

This is a moderate, not top-priority, risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-deliverable, unauthenticated information-disclosure flaw whose single real gate is user interaction (UI:R) - the victim must open a crafted Excel file. The impact is confidentiality-only (C:H, I:N, A:N), consistent with an out-of-bounds read (CWE-125) that leaks memory contents rather than enabling code execution. CISA's SSVC decision framework corroborates a lower operational urgency: Exploitation=none, Automatable=no, Technical Impact=partial - i.e. no observed exploitation, not wormable/scriptable at scale, and only partial impact. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified. The CVE is NOT in CISA KEV and no POC is referenced. All signals align rather than conflict: a genuine but second-tier issue - the C:H/network-vector raises the score, while required user interaction, confidentiality-only impact, and SSVC 'Exploitation: none' temper real-world urgency. Note the input Tags include 'Buffer Overflow,' which is imprecise for an out-of-bounds READ (CWE-125 is a read primitive, not a classic write overflow); do not treat this as a memory-corruption/RCE bug on the basis of that tag.

An attacker emails or hosts a specially crafted Excel spreadsheet; when a victim opens it, a parsing routine reads past an allocated buffer and returns out-of-bounds memory contents (e.g. heap data) back to the attacker, potentially disclosing sensitive information from the Office process. No public exploit code is identified at time of analysis, and because UI:R applies, success depends on convincing the user to open the file (classic phishing-style delivery over AV:N).