Microsoft Excel CVE-2026-88201

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel document in Microsoft Office Excel (LTSC 2021 before 16.0.14334.20974, LTSC 2024 before 16.0.17932.21056, or an unpatched Microsoft 365 Apps for Enterprise build); the malformed file content drives the parser into reading beyond an allocated buffer (CWE-126). The decisive LIMITING factor is the mandatory user interaction (UI:R) - there is no server-side or zero-click path - so the attack depends on social engineering to get the file opened. No special non-default configuration is required (AC:L, PR:N), and impact is confined to disclosure of in-process memory contents (C:H, I:N, A:N); Protected View / Mark-of-the-Web sandboxing on files from untrusted sources further reduces real-world exposure.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 6.5) describes a network-delivered, low-complexity, unauthenticated attack that nonetheless REQUIRES user interaction (UI:R) and yields only confidentiality impact - no integrity or availability loss. All exploitation-pressure signals point downward and agree with each other: SSVC states Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public POC. Thus there is no public exploit identified at time of analysis. The main factors INFLATING perceived severity are the AV:N rating and C:H - but AV:N here reflects email/web delivery of a malicious document rather than a server-side remotely-reachable service, and a CWE-126 buffer over-read typically leaks adjacent process memory (which Microsoft rated C:H) rather than attacker-chosen targeted data. Net: a credible information-disclosure bug most useful as an infostealer/recon primitive or chained with other flaws, but the mandatory victim action plus non-automatable, no-known-exploitation status make widespread opportunistic attacks unlikely. Patch per the standard Office servicing cadence rather than as an out-of-band crisis.

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a user into opening it (UI:R). When Excel parses the malformed structure it reads past an allocated buffer (CWE-126), and the out-of-bounds memory contents are returned to the attacker, disclosing fragments of process memory over the network. No public exploit code is identified at time of analysis, and low attack complexity (AC:L) means a reliably crafted file would work against default Excel installations.