Microsoft Excel EUVD-2026-100166

Exploitation requires the victim to open an attacker-crafted Excel document (UI:R in the CVSS vector), so this is not a zero-click flaw - a malicious .xls/.xlsx file must be delivered (e.g., via email or web download) and manually opened in a vulnerable Office build. No authentication or prior privileges are needed (PR:N), and default configurations are affected, but Protected View / Mark-of-the-Web sandboxing and user wariness of untrusted attachments meaningfully limit real-world exploitation. Affected builds are Microsoft Office LTSC 2021 (before 16.0.14334.20974), Office LTSC 2024 (before 16.0.17932.21056), and Microsoft 365 Apps for Enterprise; impact is limited to information disclosure with no integrity or availability effect.

This is a moderate-severity information-disclosure flaw (CVSS 6.5) in Microsoft Office Excel, and the available signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-delivered, unauthenticated, low-complexity attack that requires user interaction and yields confidentiality impact only - no integrity or availability effect, which matches an out-of-bounds read (CWE-125). The CISA SSVC assessment reinforces a lower-priority posture: Exploitation=none (no observed activity), Automatable=no (the required user interaction prevents mass/worm-style automation), and Technical Impact=partial (consistent with limited memory disclosure, not full compromise). There is no CISA KEV listing and no public exploit identified, and no EPSS score was provided in the input, so near-term mass-exploitation likelihood cannot be quantified from this data. Net: despite the ubiquity of Excel, this is not a drop-everything emergency - it is a patch-in-normal-cycle issue because exploitation needs a victim to open a crafted file and only leaks information. The one caveat worth verifying with the vendor is the C:H rating: many OOB-read bugs leak bounded adjacent heap memory, so the 'High' confidentiality impact may overstate real-world data exposure.

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a victim into opening it; when Excel parses the malformed structure, an out-of-bounds read exposes adjacent process memory that can be exfiltrated back to the attacker. No public exploit code has been identified, and success depends on the victim actually opening the file, so delivery would typically rely on phishing or social engineering.