Microsoft Excel EUVD-2026-44038

Exploitation requires that the target user actively open a maliciously crafted Excel file on a system running a vulnerable Office build - this is the UI:R (user interaction required) condition encoded in the CVSS vector. The local attack vector (AV:L) means the file must be processed by the Excel application on the victim's machine; the vulnerability is not remotely triggerable over a network protocol without user interaction. No authentication or elevated privileges are required from the attacker's perspective (PR:N), but a human user must perform the file-open action. Exploitation is limited to confidentiality impact only - no code execution or data modification is possible through this flaw. Office Protected View (which opens untrusted files in a sandboxed read-only mode) may prevent trigger depending on the document's trust zone designation.

The aggregate risk signal across all available sources consistently points to a low-priority issue. The CVSS 3.3 base score reflects a local attack vector requiring user interaction with no privileges needed, scoped to partial confidentiality loss only. EPSS at 0.27% (19th percentile) indicates the vulnerability is less likely to be exploited than roughly 81% of tracked CVEs - a strong indicator that opportunistic mass exploitation is not expected. CISA's SSVC assessment reinforces this: exploitation status is none, the attack is not automatable, and technical impact is only partial. No KEV listing and no public POC code have been identified at time of analysis. The primary real-world concern is targeted spear-phishing - an attacker crafting a weaponized Excel file to leak heap memory from a specific victim's Office process - rather than widespread exploitation. The Microsoft Office product family's ubiquitous enterprise footprint elevates organizational exposure in volume, but the constrained impact (information disclosure only, no code execution) and user-interaction requirement reduce urgency relative to the footprint size.

An attacker crafts a malicious Excel spreadsheet (.xlsx or legacy format) that triggers the heap-based buffer overflow during document parsing. The file is delivered to a target user via email attachment or a shared drive, and when the user opens it in a vulnerable Excel version, heap memory adjacent to the overflowed buffer is disclosed - potentially leaking sensitive in-process data such as recently accessed strings, tokens, or document fragments. No public POC exists at time of analysis, but the user-interaction-only barrier makes social engineering a viable delivery mechanism for targeted attacks.