EUVD-2026-100298
GHSA-9r4m-2p3p-7j6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via email/web
-
DeliveryVictim opens malicious spreadsheet
-
ExploitTrigger integer underflow in Office parser
-
ExecutionCorrupt memory and hijack execution
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Excel document (UI:R) in a vulnerable Office/Excel build - e.g. versions below the patched ceilings such as Office LTSC 2021 < 16.0.14334.20974, Office LTSC 2024 < 16.0.17932.21056, or Office Online Server < 16.0.10417.20228. No authentication is needed on the target (PR:N) and the file can be delivered remotely (AV:N) via email or download, but the mandatory user interaction of opening the file is the primary limiting factor; there is no server-side or zero-click path indicated. Preview-pane handling could lower the interaction bar but is not confirmed in the available data. |
| Impact | This is a genuine high-priority vulnerability, though not a drop-everything emergency absent exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, base 8.8) describes network-reachable, unauthenticated, low-complexity code execution with full confidentiality/integrity/availability impact - the classic profile of a malicious-document RCE delivered by email or download. The single mitigating metric is UI:R: a human must open the crafted Excel file, which meaningfully slows automatable, wormable exploitation. No EPSS score was provided, so statistical exploitation likelihood cannot be quantified. KEV status is NOT present in the input, so there is no confirmation of active exploitation; POC availability is also NOT indicated. No SSVC decision data was supplied. Signals are therefore consistent (high CVSS backed by a coherent file-parsing RCE description and CWE-191 integer underflow) but incomplete on the real-world-exploitation axis. One metadata conflict must be flagged: the input Tags include 'Authentication Bypass,' which does not match an integer-underflow memory-corruption RCE - verify the tagging rather than treating this as an auth-bypass issue. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted Excel spreadsheet that triggers an integer underflow (CWE-191) in Office's parsing logic. When a victim opens the file, the underflow leads to memory corruption and arbitrary code execution in the context of the user. No public exploit code or active exploitation is indicated in the available data, so this remains a theoretical-but-credible malicious-document chain requiring user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted spreadsheet, because an integer underflow (CWE-191) in Office's document handling wraps a value and leads to memory corruption exploitable for code execution in the context of the opening user. No authentication is required on the target (PR:N) and the file can be delivered over the network via email, a link, or a shared document, but exploitation depends on the victim opening the file (UI:R), and no server-side or zero-click path is indicated. Microsoft has released fixed builds (for example Office LTSC 2021 16.0.14334.20974 and Office LTSC 2024 16.0.17932.21056), and no public exploit identified at time of analysis; treat this as a high-priority, patch-worthy issue rather than an emergency given the absence of exploitation signals.
RemediationAI
Vendor-released patch: apply the Microsoft Office security update referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97746), bringing installations to at least Microsoft Office LTSC 2021 16.0.14334.20974, Microsoft Office LTSC 2024 16.0.17932.21056, and Office Online Server 16.0.10417.20228; Microsoft 365 Apps for Enterprise and Microsoft 365 for Mac should be updated to the latest Current/LTSC builds published at https://aka.ms/OfficeSecurityReleases, and Office 365 for Mac and Office LTSC for Mac users should install the newest released build for their channel. Where immediate patching is not possible, apply layered compensating controls focused on the user-interaction prerequisite: disable the Outlook/Explorer Preview Pane for Office file types and enforce Protected View and file-block policies for untrusted attachments and downloaded workbooks (trade-off: reduced document preview convenience and occasional false blocks on legitimate files), and block or quarantine legacy/dangerous formats such as .xls, .xlsm, and .xlsb from external senders at the mail gateway and web proxy (trade-off: legitimate macros-driven workflows break unless allow-listed). Additionally, run Excel as a standard user rather than local administrator and use Defender Application Guard or equivalent isolation for opening untrusted workbooks, which contains corruption in a sandbox at the cost of slower document open times. Patch availability is confirmed from the vendor, and no public exploit code or confirmed active exploitation was identified at the time of analysis, so prioritization should follow normal high-severity patch windows with emphasis on endpoints whose users routinely open externally sourced spreadsheets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-191, integer underflow with wraparound: a size or offset value used while parsing/handling an Excel document is decremented below zero, wraps to a very large unsigned value, and is subsequently used in buffer or length arithmetic, producing memory corruption that can be shaped into code execution. The affected surface is the Excel client and its associated Office render/handling stack, including Microsoft 365 Apps for Enterprise, the perpetual Office LTSC 2021 and LTSC 2024 channels, Office Online Server, and the corresponding Mac builds, which share substantial file-format parsing code. The assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H means the weaponized file is delivered remotely with no privileges needed on the target, the exploitability is not complicated, and the user must open the file; impact within the affected component is high for confidentiality, integrity, and availability, with scope unchanged, so the practical ceiling is code execution as the interactive user rather than a privilege boundary bypass. The EUVD entry (EUVD-2026-100298) and MSRC advisory confirm vulnerable version ceilings rather than a design-level protocol flaw, indicating the fix is a bounds/length validation correction in the Office builds listed below. Note that one intelligence tag references 'Authentication Bypass'; the authoritative assessment does not support authentication bypass as the primary mechanism, and the stated vector (PR:N) simply reflects that no credentials are required to trigger the file handler, not that a security control is bypassed.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-delivered RCE is remotely reachable (AV:N) and unauthenticated (PR:N) but needs the user to open the document (UI:R), yielding full C/I/A impact in-process (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity vulnerability in Microsoft Excel could allow an attacker to execute malicious code on a user's system when they open a specially crafted spreadsheet. Successful exploitation could result in unauthorized access to sensitive data, system compromise, and potential lateral movement within the network, impacting organizational confidentiality, integrity, and availability. Given Excel's widespread use for critical business functions, immediate patching is essential to mitigate this risk and protect our operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB