EUVD-2026-35661
GHSA-grp5-mh23-v8jr
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel can be achieved by an unauthenticated attacker who tricks a user into opening a malicious spreadsheet that triggers an integer underflow condition. The flaw carries a CVSS 7.0 rating reflecting high attack complexity and required user interaction, and no public exploit identified at time of analysis. There is a notable mismatch between the description (integer underflow) and the assigned CWE-362 (race condition), which warrants verification with Microsoft's advisory.
Technical ContextAI
The vulnerability resides in Microsoft Office Excel, a spreadsheet application that parses numerous complex binary and XML-based file formats (XLS, XLSX, XLSB, etc.) including embedded objects, formulas, and OLE streams. The description identifies an integer underflow (wrap-around), a memory safety class where an arithmetic operation produces a value below the minimum representable integer, typically resulting in undersized buffer allocations or incorrect loop boundaries that lead to out-of-bounds writes. However, the assigned CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e., a race condition) and the 'Race Condition' tag suggest the underlying bug may instead involve a TOCTOU or threading flaw during parsing, with the integer underflow being one observable outcome of the race window.
RemediationAI
Apply the Microsoft security update for Excel as listed on the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44818; exact fix build numbers are not present in the provided input and should be taken from that advisory. As compensating controls until patching, enable Protected View for files originating from the Internet and Outlook attachments (Excel → Trust Center → Protected View) so untrusted workbooks open in a sandboxed read-only mode, configure Attack Surface Reduction rules to block Office applications from creating child processes and from injecting code into other processes, and block or quarantine Excel file types (.xls, .xlsx, .xlsm, .xlsb, .xltm) at the email gateway for external senders. Side effects: Protected View can frustrate users who legitimately receive external workbooks, ASR child-process blocking can break legacy macros and add-ins that spawn helper executables, and gateway blocking will disrupt normal business workflows with external partners and should be paired with a safe-attachment detonation service.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today