EUVD-2026-44160
GHSA-gmj3-jv2h-3mhj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-borne exploitation is local (AV:L) and needs a user to open the workbook (UI:R) but no attacker privileges (PR:N); code execution yields full C/I/A in the user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (Office 2016 through LTSC 2024, Microsoft 365 Apps, and Mac editions) allows an attacker to run arbitrary code by tricking a user into opening a maliciously crafted spreadsheet that triggers a type-confusion condition in Excel's file parser. The CVSS 3.1 score is 7.8 (High) with the local vector reflecting file-open exploitation rather than remote-network access, and success requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The root cause is CWE-843 (Access of Resource Using Incompatible Type, or 'type confusion'), a memory-safety flaw in which Excel accesses an object or memory region as one type while it was allocated or interpreted as another. In Office file parsers this typically arises when handling structured spreadsheet content (records, embedded objects, or serialized structures) whose type tag is trusted without validation, letting an attacker supply data that is later dereferenced as an incompatible type - corrupting memory and yielding control-flow hijacking. The affected code is Excel's client-side document-processing engine, shared across the Windows Office family (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), the macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024), and the server-side Office Online Server per the provided CPE list.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55024, using Microsoft Update / Click-to-Run for Microsoft 365 Apps and the Mac editions, and the corresponding monthly security update for Office 2016/2019 and Office LTSC 2021/2024; update Office Online Server separately as it patches independently. Exact fixed build numbers should be taken from the MSRC page since they are not provided in this dataset. Where immediate patching is not possible, reduce exposure by opening untrusted spreadsheets in Protected View and blocking Office files from executing content from the internet (Mark-of-the-Web enforcement), and consider Attack Surface Reduction rules that restrict Office child-process creation - the trade-off being that Protected View and ASR rules can disrupt legitimate macro-enabled or automated workflows and may generate user friction.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today