Microsoft Excel EUVD-2026-44161

Exploitation requires a local user to actively open a specially crafted Excel file - user interaction (UI:R) is mandatory and cannot be bypassed remotely without the user first saving and opening the file. The attack vector is local (AV:L per CVSS), meaning delivery relies on social engineering (phishing, shared drive, USB) rather than direct network exploitation. No authentication or elevated privileges are required to open an Excel file (PR:N). Protected View - Microsoft's sandboxed preview mode enabled by default for files downloaded from the internet - would block the parser from fully processing the file unless the user clicks 'Enable Editing', which is a meaningful mitigation barrier. Exploitation is strictly limited to information disclosure; no code execution, privilege escalation, or data modification is possible through this vulnerability alone. The flaw affects both Windows and macOS Office installations, as confirmed by CPE data spanning Windows and Mac LTSC/365 product lines.

The CVSS 5.5 score reflects a tightly constrained attack surface: local attack vector (AV:L) means the malicious file must be on or accessible from the victim's machine, no privileges are required to open an Excel file (PR:N), but mandatory user interaction (UI:R) introduces a required social engineering step. The high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) limits the realistic damage to memory disclosure rather than code execution or data modification. EPSS at 0.35% (27th percentile) is low and aligns with SSVC's classification of 'Exploitation: none' and 'Automatable: no' - automated mass exploitation is not feasible given the UI:R requirement. SSVC's 'Technical Impact: partial' is consistent with an information-disclosure-only flaw. No CISA KEV listing and no public POC reference further reduce urgency. The combination of local delivery, required user interaction, information-disclosure-only impact, low EPSS, and SSVC exploitation status of none makes this a patch-cycle priority rather than an emergency response item. The C:H rating could be alarming in isolation, but the local-only, user-interaction-required delivery significantly narrows real-world exploitability compared to remotely triggerable RCE vulnerabilities.

An attacker crafts a malicious Excel workbook containing a malformed record with an attacker-controlled length field that causes the parser to read beyond the allocated buffer boundary, then delivers the file to a target via a phishing email attachment or a shared network drive. When the victim opens the file in an unpatched version of Excel, the out-of-bounds read occurs and adjacent process memory - potentially containing sensitive data such as credentials, document content, or cryptographic material loaded elsewhere in the Excel process - may be disclosed. No public exploit code has been identified at time of analysis.