EUVD-2026-35665
GHSA-69c6-79jc-fjhr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel stems from an integer underflow that, when triggered by opening a crafted spreadsheet, allows an attacker to run arbitrary code in the context of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation requires the victim to open a malicious file, and there is no public exploit identified at time of analysis. With a base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation effectively gives the attacker the victim's privileges on the host.
Technical ContextAI
The root cause is CWE-197 (Numeric Truncation Error), here manifesting as an integer underflow / wraparound inside Excel's file-parsing code. When an arithmetic operation on a length, offset, or size field produces a value smaller than expected and wraps around, the resulting tiny or negative value is reinterpreted as a very large unsigned quantity, leading to undersized buffer allocations or out-of-bounds memory accesses during subsequent parsing of spreadsheet structures (e.g., BIFF/OOXML records, embedded objects, or formula data). Because Excel parses these structures in-process before any sandboxing of macro/script content takes effect, memory corruption in this path can be steered into arbitrary native code execution within the Office process. CPE data was not provided in the input, so exact affected SKUs and build numbers must be obtained from the Microsoft Security Update Guide reference.
RemediationAI
Apply the Microsoft security update for CVE-2026-44823 as published on the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44823; the exact patched build is not included in the input data and should be taken directly from that advisory for each affected Office channel (Click-to-Run, MSI, LTSC). Until patching is complete, reduce exposure by enforcing Protected View and Office File Block policy for spreadsheets originating from the Internet or email (which opens files read-only in a sandboxed process and blocks the vulnerable parsing path for untrusted documents, at the cost of users needing to explicitly enable editing for legitimate external files), blocking or quarantining inbound .xls/.xlsm/.xlsb attachments at the mail gateway where business workflows allow, and ensuring Attack Surface Reduction rules such as 'Block Office applications from creating child processes' are enabled to limit post-exploitation. Secondary advisory information is available at https://vuldb.com/vuln/369659.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today