Microsoft Excel EUVD-2026-100282

Exploitation requires a user to open or preview an attacker-crafted Excel workbook in an affected Office build (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Office 365 for Mac, or Office Online Server) - this is the UI:R condition and the primary limiting factor, since the bug cannot self-propagate and depends on social engineering to deliver and open the file. No authentication or elevated privileges are needed (CVSS PR:N), and no special non-default Office configuration is indicated by the description; Protected View / Mark-of-the-Web blocking or disabled macros do not necessarily mitigate a parser-level heap overflow but may reduce the likelihood of the user reaching the vulnerable code path. The affected-version strings from EUVD are partly malformed, so defenders should map exposure using the fixed builds in the MSRC advisory rather than the EUVD text.

This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, unauthenticated, low-complexity code execution with full confidentiality, integrity and availability impact, gated only by user interaction (UI:R) - the classic Office 'open a malicious document' pattern rather than a server-side worm. Against that, the real-world exploitation signals are muted: no EPSS score was supplied, the CVE is NOT on CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore consistent but incomplete: severity is high and the bug class (CWE-122 heap overflow in a client parser) is historically very attractive to attackers and phishing operators, yet there is currently no evidence of active or automated exploitation. The UI:R requirement is the single biggest limiter - this cannot self-propagate and depends on social engineering. Priority: patch promptly given ubiquity and impact, but absence of KEV/POC/EPSS means this is 'patch in normal-to-expedited cycle,' not 'emergency.' Note: no EPSS, KEV, POC or SSVC data was provided in the input, so the exploitation-likelihood dimension is unverified rather than low.

An attacker crafts a malicious Excel workbook that triggers a heap-based buffer overflow in Office's parsing code and delivers it via phishing email or a download link. When the victim opens the file, the overflow corrupts heap memory and the attacker achieves arbitrary code execution in the context of the current user. No public exploit code is identified at time of analysis, and successful exploitation requires the user to open the attacker-supplied file (UI:R).