Microsoft Excel EUVD-2026-100164

Exploitation requires the victim to open an attacker-crafted Excel file locally in Microsoft Office Excel (CVSS UI:R, AV:L); there is no remote or network-triggerable path and no authentication is required of the attacker (PR:N). The primary limiting factors are: mandatory user interaction (the target must be convinced to open the malicious document), the local/file-based attack vector that precludes mass or automated exploitation (SSVC Automatable=no), and an impact limited to information disclosure (C:H, I:N, A:N) - no code execution or data modification. Affected builds are Microsoft 365 Apps for Enterprise, Office LTSC 2024 (below 16.0.17932.21056), and Office LTSC 2021 (below 16.0.14334.20974); patched builds are not exploitable.

This is a moderate, non-priority issue despite a HIGH confidentiality impact in the CVSS vector. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity, unauthenticated-but-user-interaction-required out-of-bounds read (CWE-125) that discloses memory contents with no integrity or availability impact. All three forward-looking exploitation signals point AWAY from urgency and are mutually consistent: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial; there is no CISA KEV listing and no public exploit identified in the provided data. The 'AV:L' plus 'UI:R' combination means this is not a remotely-triggerable server bug - it requires a victim to open a crafted file locally, so it cannot be mass-exploited or wormed, which aligns with Automatable=no. The only tension worth noting is the C:H rating against an out-of-bounds READ that leaks information: Microsoft rates the confidentiality impact as HIGH, but an info-disclosure read typically yields fragments of process memory rather than guaranteed full secret recovery - treat C:H as the vendor's conservative rating, not proof of reliable sensitive-data extraction. Net: real but low operational priority; patch on normal Patch Tuesday cadence rather than emergency.

An attacker emails or otherwise delivers a maliciously crafted spreadsheet to a target and relies on social engineering to get the victim to open it in Microsoft Excel. When Excel parses the malformed file structure, an out-of-bounds read exposes adjacent process memory, which the attacker can exfiltrate (e.g., via crafted file content rendered back to the attacker or embedded tracking). No public exploit code is identified at time of analysis, and the local attack vector with required user interaction limits this to targeted, not opportunistic, use.