Microsoft Excel EUVD-2026-100291

Exploitation requires the victim to open an attacker-crafted Excel workbook in Microsoft Office Excel (UI:R) - there is no remote, interaction-free attack path despite the AV:N vector, which reflects file delivery over email/web rather than network-service exploitation. No authentication or prior privileges are needed (PR:N), and default Office configurations are affected (the flaw is in the file parser itself). The primary limiting factor is the required user action of opening/previewing the malicious file; Protected View, Mark-of-the-Web blocking, and attachment filtering materially reduce real-world exploitability. Affected scope spans Windows and Mac Office builds (LTSC 2021/2024, Office LTSC/365 for Mac, Office Online Server, M365 Apps for Enterprise) below the listed patched versions.

This is a genuine high-priority issue, though not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-deliverable, low-complexity, unauthenticated memory-corruption flaw yielding full code execution (C:H/I:H/A:H), consistent with the classic weaponized-document pattern for Office/Excel. The single mitigating signal is UI:R - exploitation requires the victim to open a malicious workbook, so this is not a wormable, zero-click bug despite the 'network' label; the AV:N classification reflects email/web delivery of the file rather than true remote service exploitation. No EPSS score, CISA KEV listing, or POC indicator is present in the input, so there is no evidence of active exploitation or public exploit code at this time; the absence of these signals does not lower the intrinsic severity but means urgency rests on the heavily-targeted nature of the Office file-parsing attack surface rather than confirmed in-the-wild activity. Conflicting-signal note: the AV:N vector combined with UI:R should be read as 'remote delivery, local user action,' not remote-service compromise - defenders should treat this as a phishing/malicious-attachment risk, not a perimeter-facing listener bug.

An attacker crafts a malicious Excel spreadsheet that triggers a heap-based buffer overflow (CWE-122) in Office's parsing code and delivers it via phishing email or a web download. When the victim opens the file (UI:R), the overflow corrupts heap memory and executes arbitrary code in the context of the user, with no authentication required (PR:N). No public exploit code is identified at time of analysis.