Microsoft Excel EUVD-2026-100184

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel file in Microsoft Office Excel; the malformed content triggers the out-of-bounds read during file parsing. The key limiting factor is mandatory user interaction (UI:R) - there is no server-side or zero-click path - so delivery relies on social engineering (email attachment, download, or shared document). Impact is confined to information disclosure (C:H/I:N/A:N): it leaks process memory but does not by itself grant code execution, modification, or denial of service. Affected builds per EUVD include Microsoft 365 Apps for Enterprise, Office LTSC 2021 (<16.0.14334.20974), Office LTSC 2024 (<16.0.17932.21056), and the corresponding Office for Mac editions; fully patched builds are not exploitable.

This is a moderate-severity information-disclosure flaw whose signals are internally consistent and point AWAY from urgent, widespread exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-deliverable, unauthenticated issue that nonetheless REQUIRES user interaction (UI:R) - i.e. the victim must open a malicious workbook - and yields confidentiality loss only (C:H, I:N, A:N), which caps the real-world impact at data/memory disclosure with no code execution or integrity/availability effect. CISA's SSVC decision framework corroborates low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no POC reported in the supplied data, so the correct exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one tension worth noting is between the tags and the root cause: the issue is tagged 'Buffer Overflow' but CWE-125 and the description define an out-of-bounds READ, not an overflow/write - the lower-impact read semantics (memory disclosure, not control-flow hijack) are consistent with C:H/I:N/A:N and should govern the risk read. Net: a genuine but non-emergency patch-in-normal-cycle item, elevated mainly by Excel's enormous install base rather than by any active-exploitation signal.

An attacker emails or hosts a specially crafted Excel workbook and lures a user into opening it in a vulnerable version of Microsoft Office Excel. When Excel parses the malformed file, an out-of-bounds read exposes adjacent process memory, which can be exfiltrated back to the attacker (often useful for leaking secrets or defeating ASLR ahead of a separate exploit). No public exploit code is identified in the provided data, and successful attack depends on user interaction (UI:R).