Microsoft Excel EUVD-2026-100378

Exploitation requires the victim to open an attacker-supplied malicious Excel file in Microsoft Office Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20878, or Office LTSC 2024 before 16.0.17932.20934) - this mandatory user interaction (UI:R) is the primary limiter and prevents automated or wormable exploitation. No authentication or elevated privileges are needed (PR:N). Impact is limited to disclosure of in-process memory (C:H, I:N, A:N); the flaw does not grant code execution, data modification, or denial of service. Affects default configurations once a crafted file is opened; no special feature toggle is required.

This is a moderate-priority information-disclosure flaw, not a critical mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes an unauthenticated, low-complexity attack but one that REQUIRES user interaction (UI:R) - meaning a victim must open a malicious Excel file, so this is not self-propagating. All exploitation signals point low: CISA's SSVC decision shows Exploitation=none (no observed or expected exploitation), Automatable=no (consistent with the UI:R requirement defeating mass automation), and Technical Impact=partial (consistent with C:H but I:N/A:N - read-only memory disclosure, no code execution or integrity loss). No EPSS score was provided in the input, and there is no KEV listing and no POC - so there is 'no public exploit identified at time of analysis.' The one point of tension worth noting: the vector is rated AV:N, but the actual delivery is a file that must be opened locally by the user; Microsoft conventionally scores document-parsing bugs as AV:N because the malicious file traverses the network (email/web), and the UI:R flag captures the real-world limiter. Bottom line: a legitimately-rated medium issue whose breadth is capped by required user interaction and read-only impact - patch on normal cycle rather than emergency.

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a target into opening it in Microsoft Excel. When Excel parses the malformed file, an out-of-bounds read (CWE-125) occurs, leaking adjacent process memory - potentially including sensitive data or address-space information useful for bypassing mitigations - back to content the attacker can observe. No public exploit code or active exploitation has been identified at time of analysis.