Microsoft Excel EUVD-2026-100178

Exploitation requires a user to open or preview an attacker-supplied, specially crafted Excel spreadsheet in Microsoft Office Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the macOS Office editions listed in EUVD) - the mandatory user interaction (UI:R) is the primary limiting factor, meaning there is no remote, zero-click, or unauthenticated-service exposure. No special non-default configuration is needed (AC:L, PR:N), and any environment running a vulnerable Office build is susceptible, but the attacker must still socially engineer the victim into opening the file, and impact is limited to disclosure of in-process memory (C:H only; no write, code-execution, or denial-of-service effect).

This is a moderate-severity information disclosure flaw, not a top-tier emergency, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 6.5) describes a network-delivered, low-complexity, unauthenticated attack that nonetheless REQUIRES user interaction (UI:R) and yields only confidentiality impact (C:H, with no integrity or availability effect) - classic for a client-side out-of-bounds read triggered by opening a malicious Excel file. CISA's SSVC framework reinforces a lower priority: Exploitation=none (no observed exploitation), Automatable=no (each attack needs a user to open a file, so it does not scale via automated mass exploitation), and Technical Impact=partial (read-only memory disclosure, not full compromise). There is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. Net assessment: a real but manageable patch-on-normal-cycle issue - the high C-only impact and ubiquity of Excel keep it relevant, while mandatory user interaction and non-automatable delivery argue against treating it as a drop-everything priority.

An attacker emails or hosts a specially crafted spreadsheet and lures a victim into opening it in Microsoft Excel; the malformed file triggers an out-of-bounds read that leaks adjacent process memory (potentially containing sensitive data such as pointers or fragments of other documents) back to the attacker. Because CVSS specifies UI:R, the attack cannot succeed without the victim opening the file, and low attack complexity (AC:L) means no special timing or conditions are needed once it is opened. No public proof-of-concept or active exploitation is referenced in the available data.