Microsoft Excel EUVD-2026-100321

Exploitation requires the victim to open or preview a specially crafted Excel workbook (UI:R in the CVSS vector), making successful attacks dependent on social engineering or file delivery rather than direct remote access; there is no server-side or zero-click path indicated. The vector grants code execution in the context of the user who opens the file (S:U, no privilege escalation implied), so a non-administrator victim limits immediate impact to that user's privileges. Limiting factors: mandatory user interaction, reliance on the user ignoring Protected View / Mark-of-the-Web warnings, and the need to lure a specific user into opening the attachment; default Office hardening (Protected View for files from the internet) meaningfully reduces real-world exploitability.

Signals are moderately strong but not top-tier urgent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 (High) and describes a network-deliverable, low-complexity, unauthenticated code-execution flaw - but the UI:R flag is decisive: exploitation requires a victim to open or preview a malicious Excel file, which means this is not a wormable or server-side remote flaw despite the 'over a network' phrasing in the description. The 'network' vector here reflects file delivery (email attachment, download, share) rather than direct remote service exploitation. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was indicated, so there is no evidence of active or imminent mass exploitation. CWE-122 (heap-based buffer overflow) in Office file parsers is a historically heavily-exploited bug class, which raises concern for eventual weaponization, but as of this analysis it remains a patch-priority item driven by prevalence and bug class rather than by confirmed exploitation. Note the apparent tension to verify: the description says 'execute code over a network' while the vector's UI:R confirms user interaction is mandatory - these are consistent only if 'network' is read as the delivery channel, not unauthenticated server exploitation.

An attacker crafts a malicious Excel workbook that triggers a heap buffer overflow in Excel's file-parsing code and delivers it via phishing email, a shared drive, or a download link. When the targeted user opens the file, the overflow corrupts heap memory and allows the attacker's code to run in the context of the current user. No public exploit code was identified at time of analysis, so exploitation currently requires original research or reverse-engineering of the patch.