Microsoft Excel EUVD-2026-100287

Exploitation requires the victim to open or preview a maliciously crafted Excel workbook in an affected Office build (UI:R in the CVSS vector) - there is no server-side or fully-remote unauthenticated path despite the AV:N labeling. Limiting factors: the attack depends entirely on user interaction (opening the attacker's file), so Protected View, Mark-of-the-Web blocking, and disabling automatic file previews materially reduce exploitability; no authentication or special target configuration is otherwise needed, and affected products span Office LTSC 2021/2024, Office LTSC/365 for Mac, Office Online Server, and Microsoft 365 Apps for Enterprise per EUVD-2026-100287.

This is a credible, actionable priority rather than a paper-high score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, score 8.8) describes low-complexity remote code execution requiring no privileges but mandating user interaction - consistent with the classic Office Excel file-open attack pattern, where 'network' really means a maliciously crafted workbook delivered by email, web, or share rather than a directly remotely-reachable service. The UI:R requirement meaningfully tempers real-world risk: a victim must open or preview the attacker's file, so this is not wormable or server-side auto-exploitable. No EPSS probability, no SSVC decision data, and no POC indicator were supplied, and the vulnerability is NOT in CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a data discrepancy: the description explicitly states a heap-based buffer overflow (CWE-122/CWE-787 territory) while the assigned CWE is CWE-20 (Improper Input Validation) - a common Microsoft mapping choice, but verify root cause with the MSRC advisory. Bottom line: high impact and low attacker effort once a file is opened, offset by the dependence on user interaction and the current absence of any exploitation or POC signal - patch promptly, especially for Office-heavy user populations, but it does not demand emergency out-of-band response absent new exploit intelligence.

An attacker crafts a malicious Excel workbook that triggers a heap-based buffer overflow during parsing and emails it to a target or hosts it on a web/file share. When the victim opens the file in an affected Office/Excel build, the overflow corrupts heap memory and allows execution of arbitrary code in the context of the user. No public proof-of-concept or active exploitation is identified in the provided data.