Microsoft Excel CVE-2026-88195

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel spreadsheet in an affected build of Microsoft 365 Apps for Enterprise, Office LTSC 2024 (before 16.0.17932.21056), or Office LTSC 2021 (before 16.0.14334.20974); the malformed file triggers a buffer over-read during parsing. The primary limiting factor is the required user interaction (UI:R) - there is no drive-by or server-side auto-exploitation path - and the impact is confined to disclosure of in-process memory (C:H only, no code execution or file modification). No special Excel configuration or feature toggle is named in the advisory; the flaw is in default document-parsing behavior, so Protected View / Mark-of-the-Web mitigations that block automatic content execution reduce but do not necessarily eliminate exposure.

This is a moderate-severity information disclosure flaw (CVSS 6.5) rather than a top-priority emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a network-deliverable, unauthenticated, low-complexity attack, but the mandatory user interaction (UI:R) means a victim must open a crafted Excel file, which substantially lowers real-world exploitability. Impact is confidentiality-only (C:H/I:N/A:N) via a buffer over-read (CWE-126), so there is no code execution or integrity/availability loss. All exploitation signals point low: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no public exploit identified at time of analysis. EPSS is not provided in the input, so the statistical exploitation probability is unknown and cannot be weighed. The signals are mutually consistent (high CVSS confidentiality impact offset by required user interaction and no observed exploitation), with no contradictions - the 'network' attack vector is consistent with a document-opening scenario where the malicious file arrives via email or a web download. Overall this is a 'high-exposure product, low current exploitation pressure' issue: patch on a normal cycle, not an out-of-band emergency.

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a user into opening it; when Excel parses the malformed structure it reads beyond an allocated buffer and leaks adjacent memory contents (potentially heap data such as pointers or document fragments) back to the attacker. No public exploit code or active exploitation has been identified, and successful attack depends on the victim opening the file (UI:R).