EUVD-2026-100322
GHSA-pj29-hgrw-877w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via email/web
-
DeliveryVictim opens malicious spreadsheet
-
ExploitTrigger use-after-free in Excel parser
-
ExecutionCorrupt freed memory object
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted Excel file (UI:R in the CVSS vector), which is the primary limiting factor - this is user-interaction-gated, not zero-click. No authentication or prior privileges are needed (PR:N), and delivery is over a network (AV:N) via standard vectors such as email attachments or web downloads against default Excel installations; no special non-default configuration is indicated in the description. The attack runs in the security context of the user who opens the document, so impact is bounded by that user's privileges (S:U). |
| Impact | This is a credible prioritization candidate but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated use-after-free (CWE-416) in Excel that yields full confidentiality, integrity, and availability impact - classic weaponizable Office RCE via a crafted spreadsheet. The one meaningful brake is UI:R: a user must open the malicious file, so this is not a wormable, zero-click flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or available exploit code at time of analysis - meaning the 8.8 reflects potential severity, not demonstrated real-world attack activity. SSVC-style signals (automatable, exploitation status) are not supplied in the input and cannot be asserted. Given Excel's enormous install base, memory-corruption RCE in Office historically does attract exploitation, so patch promptly, but current data shows no confirmed in-the-wild use. Note the 'Denial Of Service' tag conflicts with the full C:H/I:H/A:H code-execution impact in the description - treat this as an RCE, not merely a DoS. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted Excel spreadsheet and lures a victim into opening it. Parsing the malicious content triggers a use-after-free, corrupting memory and allowing arbitrary code execution in the context of the user who opened the file. No public exploit code is identified at time of analysis, and because UI:R applies, exploitation depends on the victim opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Microsoft Excel allows an unauthorized attacker to execute arbitrary code when a victim opens a crafted spreadsheet, per the vendor advisory for CVE-2026-100212. The issue is a use-after-free (CWE-416) reachable over the network with no privileges required (AV:N/PR:N), but exploitation is gated by user interaction (UI:R) and runs in the security context of the user who opens the file (S:U). No public exploit identified at time of analysis, and the independent assessment rates it a credible prioritization candidate but not an emergency.
RemediationAI
No vendor-released patch identified at time of analysis; administrators should monitor and apply the Microsoft Excel security update for CVE-2026-100212 from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100212 as soon as it is available. Until a patch is confirmed, reduce exposure by enforcing Excel Protected View and Mark-of-the-Web for files originating from email or the internet, which prevents automatic parsing of untrusted workbooks but can disrupt legitimate workflows and may prompt users to click through protections. Consider Microsoft Defender Application Guard for Office to open untrusted spreadsheets in an isolated container, accepting potential performance and compatibility overhead, and review Attack Surface Reduction rules such as 'Block Office applications from creating child processes' to contain post-exploitation activity, recognizing that such rules may interfere with legitimate macros or add-ins. Email and web gateway controls that quarantine or strip Excel attachments from untrusted sources should also be used, with the trade-off of blocking benign business documents.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Excel is a document-processing application that parses complex spreadsheet files; this vulnerability is a use-after-free (CWE-416), a memory-corruption class in which a program continues to reference memory after it has been freed, often enabling attacker-controlled data to be interpreted as code or pointers. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-deliverable flaw that needs no authentication or prior privileges, but requires the victim to open or interact with a crafted Excel file, after which code executes in the user's context rather than elevating privileges. The provided tags (Denial Of Service, Use After Free, Memory Corruption, Microsoft) reinforce the memory-safety nature of the bug; although DoS is tagged, the CVSS impact is C:H/I:H/A:H, so code execution is the dominant risk. No CPE strings were supplied, so the exact affected Excel build or component is not confirmed from the available data; the reference is Microsoft's CVE-2026-100212 update guide, and the independent assessment notes this affects default Excel installations via standard delivery channels such as email attachments or web downloads, with no special non-default configuration indicated.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted-file RCE delivered over the network with no privileges (PR:N) but requiring the victim to open the file (UI:R); full C/I/A loss in the user's context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity remote code execution vulnerability in Microsoft Excel (CVE-2026-100212, CVSS 8.8) lets an attacker run arbitrary code on a workstation in the context of any user who simply opens a crafted spreadsheet, which places finance, HR, procurement, and other spreadsheet-heavy teams on the front line. No vendor-released patch is identified at time of analysis and no public exploit identified at time of analysis, so the immediate exposure is driven by user behavior rather than by active attacks. Leadership should treat this as a bounded but real risk: a short window exists to reduce the attack surface through endpoint, email, and Office configuration controls before a fix is published.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing Protected View and Mark-of-the-Web for documents from untrusted sources, disabling or restricting macros and ActiveX in Excel via Group Policy or Intune, blocking high-risk spreadsheet attachment types at email and web gateways, deploying Microsoft Defender Application Guard for Office, enabling relevant attack surface reduction rules and EDR monitoring for Office child-process and network activity, and reinforcing user reporting of suspicious documents. Note the flaw is unauthenticated over the network (CVSS PR:N) but requires the victim to open a crafted file (UI:R) and executes in the user's security context.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB