Microsoft Excel EUVD-2026-100288

Exploitation requires the victim to open an attacker-supplied, maliciously crafted Excel file (UI:R in the CVSS vector) - delivered over the network via email attachment, download, or shared link - in an affected Office build. No authentication or prior access is needed (PR:N, unauthorized attacker), and attack complexity is low (AC:L), so no special target-side configuration is required beyond a vulnerable Excel version. The single meaningful limiting factor is the mandatory user interaction of opening the document; Protected View / Mark-of-the-Web sandboxing and user wariness of untrusted files reduce real-world exploitability. Affected scope spans Office Online Server (<16.0.10417.20228), Microsoft 365 Apps for Enterprise, Office LTSC 2021 (<16.0.14334.20974) and LTSC 2024 (<16.0.17932.21056), plus Office LTSC for Mac 2021/2024 and Office 365 for Mac.

This is a credible high-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-execution flaw whose only gating factor is user interaction (UI:R) - the canonical profile of a malicious-document attack against Microsoft Office Excel. A patch is confirmed available from the vendor (Microsoft, via MSRC), which raises urgency because the fix itself discloses the defect to reverse-engineers. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was supplied in the input, so there is NO evidence of active exploitation and NO confirmation that weaponized code circulates - exploitation status must be read as 'no public exploit identified at time of analysis.' The risk therefore rests on the inherent severity (memory-corruption RCE in an extremely widely deployed product) rather than on observed exploitation. Office heap-overflow RCEs of this class are historically attractive to phishing and espionage actors once patches are analyzed, so treat as prioritize-for-patching despite the absence of exploitation telemetry. No internal conflict exists in the data: the description ('execute code over a network', 'unauthorized attacker') is consistent with AV:N/PR:N, and UI:R aligns with a file-open delivery model.

An attacker emails or hosts a specially crafted Excel spreadsheet; when a victim opens it, parsing of the malformed content triggers a heap-based buffer overflow (CWE-122) that corrupts memory and executes attacker-controlled code in the context of the user. Because PR:N and the attacker is unauthorized, no credentials are needed - only that the target opens the file (UI:R). No public proof-of-concept was identified in the provided data.