EUVD-2026-29641
GHSA-whc2-9r39-wqcm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open client exploitation gives AV:L and UI:R with no privileges (PR:N); a successful use-after-free yields full code execution, so C/I/A are all High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel (Excel 2016, Office 2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a specially crafted spreadsheet. Successful exploitation yields full compromise of the current user's context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none, indicating this is a patch-in-cycle issue rather than an active threat.
Technical ContextAI
The root cause is CWE-416 (Use After Free), a memory-corruption class in which code continues to reference a heap object after it has been freed, allowing an attacker who controls the reallocated memory to hijack a dangling pointer and steer execution. In Excel this is reached through the file-parsing/rendering engine when processing a malicious workbook, so the vulnerable component is the Office desktop and server code shared across the affected SKUs. Per the CPE data, this spans the Windows Office family (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), the macOS builds (Office LTSC for Mac 2021/2024), and the server-side Office Online Server, meaning both interactive desktop use and server-side document rendering are in scope.
RemediationAI
Apply the Microsoft-released update for your Office channel as the primary fix: Vendor-released patch - Excel 2016 to 16.0.5552.1000 or later, Office for Mac (LTSC 2021/2024) to 16.109.26051019 or later, and Office Online Server to 16.0.10417.20128 or later; for Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 install the current security build via https://aka.ms/OfficeSecurityReleases, with details in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40359. Because exploitation requires a user to open a malicious file, effective compensating controls until patching completes are: enforce Protected View / Office block-macros-and-untrusted-files-from-the-internet policies so untrusted workbooks open sandboxed (trade-off: users must click to exit Protected View, mild friction), block or quarantine spreadsheet attachments (.xls/.xlsx/.xlsm) at the mail gateway from external senders (trade-off: may delay legitimate business documents), and for Office Online Server restrict document-rendering access to trusted internal sources only (trade-off: reduces external collaboration functionality).
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today