Microsoft Excel EUVD-2026-100185

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel file in a vulnerable build of Microsoft Office (per CVSS UI:R); it is not triggered against a default idle installation. No authentication is required (PR:N), and delivery is over a network (AV:N) via phishing email, shared document, or web download. The key limiting factor is this mandatory user interaction - a human must choose to open the file - which, combined with CISA's 'Automatable: no' assessment, prevents mass/wormable exploitation. Impact is limited to memory disclosure (C:H only); there is no integrity or availability impact and no code execution. Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (see vendor security-release page for the fixed build).

This is a moderate-severity (CVSS 6.5) information-disclosure flaw whose real-world priority is low-to-moderate. The signals are consistent with each other rather than conflicting: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-delivered, unauthenticated, low-complexity attack that nonetheless requires user interaction, and this aligns with CISA's SSVC decision (Exploitation: none, Automatable: no, Technical Impact: partial). The UI:R requirement is precisely why 'Automatable: no' holds - a human must open a crafted file, so this cannot be driven by a scanning worm. There is no public exploit identified and the CVE is not on CISA KEV, so no public exploit identified at time of analysis. Impact is confined to confidentiality (C:H, I:N, A:N): an out-of-bounds read (CWE-125) leaks memory contents but cannot modify data or crash the host, limiting it to information leakage rather than code execution. Net: a real but non-urgent issue - patch in normal cycle. The only minor tension worth verifying is that C:H combined with a mere out-of-bounds read may overstate the practical disclosure value, since leaked bytes are often adjacent heap/stack memory of uncertain sensitivity rather than guaranteed secrets.

An attacker crafts a malicious Excel spreadsheet and delivers it via email or a web download. When a victim opens the file in a vulnerable version of Excel, an out-of-bounds read is triggered and the contents of adjacent process memory are disclosed back to the attacker. No public proof-of-concept or exploit code has been identified, and exploitation requires the user to open the file (UI:R).