EUVD-2026-43774
GHSA-cjqx-7vg8-mm6c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Code executes locally only when a user opens a crafted file, so AV:L and UI:R; no attacker privileges (PR:N) and full RCE in user context gives C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local arbitrary code execution in Microsoft Excel arises from a heap-based buffer overflow (CWE-122) triggered when a user opens a maliciously crafted spreadsheet; successful exploitation runs attacker code in the context of the current user across desktop Office builds (Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps) on both Windows and Mac, as well as Office Online Server. The flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact but requires user interaction (opening the file). No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available from Microsoft.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-122) in the file-parsing logic of Microsoft Excel, the spreadsheet component of the Microsoft Office suite. Heap overflows occur when code writes more data into a dynamically allocated buffer than it can hold, corrupting adjacent heap structures (allocation metadata, object pointers, or function pointers) that an attacker can groom to redirect execution. In office-document parsers this class of bug is typically reached through malformed records or length fields inside a crafted workbook that the parser trusts without adequate bounds checking. The affected CPE set spans microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_office_ltsc_for_mac_2021/2024, and office_online_server - indicating the vulnerable code lives in shared Excel/Office parsing components common to Windows, macOS, and server-side rendering deployments.
RemediationAI
Patch available per vendor advisory: apply the Microsoft update for CVE-2026-58618 documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58618, which covers Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021/2024, the Mac builds, and Office Online Server (exact patched build numbers per channel are listed in the MSRC guide and are not reproduced in the input, so verify the target build there rather than assuming a version). For endpoints that cannot be patched immediately, reduce exposure by enabling Protected View / Office hardening so files from the internet and email attachments open in a sandboxed read-only mode (trade-off: users must click to enable editing, adding friction), blocking or quarantining Excel attachments (.xls/.xlsx/.xlsm) at the mail gateway from untrusted senders (trade-off: may delay legitimate business documents), and enabling Attack Surface Reduction rules for Office child-process creation on Windows. These are compensating controls only; the definitive fix is the vendor update.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today