Microsoft Excel EUVD-2026-100305

Exploitation requires a user to open or preview an attacker-crafted Excel document (UI:R) in an affected build of Microsoft Office Excel - specifically Office LTSC 2021 (<16.0.14334.20974), Office LTSC 2024 (<16.0.17932.21056), Microsoft 365 Apps for Enterprise, and the Mac Office LTSC 2021/2024 and Office 365 for Mac variants. No attacker authentication or pre-existing privileges on the target are needed (PR:N), and no special non-default product configuration is required; the primary limiting factor is the mandatory user interaction of opening the malicious file, meaning the attack hinges on successful social engineering/phishing delivery rather than direct remote triggering. Code executes in the context of the current user, so a low-privileged user account constrains the immediate blast radius absent a separate privilege-escalation chain.

This is a genuine high-priority vulnerability for environments running Microsoft Office/Excel. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-delivered, low-complexity flaw requiring no attacker privileges but requiring user interaction, with total loss of confidentiality, integrity, and availability on the host - consistent with code execution via a use-after-free (CWE-416) when a victim opens a malicious document. The single limiting signal is UI:R: exploitation depends on social engineering (a user opening a crafted file), which somewhat reduces mass-exploitation potential compared to a zero-click flaw. No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; SSVC exploitation status is therefore effectively 'none/no known exploitation' from the available data. The 'Denial Of Service' tag conflicts with the description and CVSS impact, both of which describe remote code execution, not merely DoS - treat the DoS label as incomplete. Overall: credible RCE class, patch available, but real-world risk is gated by user interaction and absence of confirmed exploitation, placing it as 'patch promptly' rather than 'emergency zero-day.'

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a user into opening it (e.g., a phishing attachment). When Excel parses the file, it triggers a use-after-free condition that the attacker leverages to execute arbitrary code in the context of the current user. No public exploit code is identified at time of analysis, and exploitation requires the victim to open the file (UI:R).