Microsoft Excel EUVD-2026-100296

Exploitation requires the victim to open a specially crafted Microsoft Excel workbook in a vulnerable Office build (UI:R); the malicious file triggers a stack-based buffer overflow during parsing. No authentication is required of the attacker (PR:N) and the file can be delivered remotely over a network (AV:N, e.g. email attachment or web download), but the attack cannot succeed without that user action - Protected View, Office hardening, or users declining to open untrusted attachments all limit real-world exploitation. Code executes only in the opening user's context (S:U), not with elevated privileges. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (fixed in 16.0.14334.20974 and 16.0.17932.21056 respectively), Office for Mac variants, and Office Online Server (fixed in 16.0.10417.20228).

This is a genuine high-priority vulnerability, though not a drop-everything emergency. The CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-deliverable code execution with low attack complexity and no privileges required, but it is gated by UI:R - the victim must open a malicious Excel file, which is the single most important mitigating factor. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code at this time - this is 'no public exploit identified at time of analysis.' That said, Office document-open memory-corruption bugs (stack-based buffer overflow, CWE-121) in Excel are a historically favored vector for phishing-driven initial access, so weaponization is plausible once details or patches are reverse-engineered. Net assessment: high real-world risk driven by Excel's ubiquity and the proven effectiveness of malicious-document phishing, tempered by the user-interaction requirement and the current absence of exploitation signals (EPSS/KEV/POC all missing from input, not confirmed absent in the wild).

An attacker emails or hosts a malicious Excel workbook (e.g. a fake invoice) that contains crafted data triggering a stack-based buffer overflow when parsed. When the victim opens the file in a vulnerable Office/Excel build, the overflow corrupts the stack and allows arbitrary code execution in the user's security context. No public exploit was identified in the provided data; attack complexity is low (AC:L) but exploitation requires the victim to open the file (UI:R).