EUVD-2026-44180
GHSA-h63h-p87q-mppp
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user (AV:L, UI:R) with no attacker privileges (PR:N); memory-corruption RCE in user context yields full C/I/A impact, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (and the broader Office suite through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from an integer underflow (CWE-191) in Excel's file parsing, letting an attacker run arbitrary code in the context of the user who opens a maliciously crafted spreadsheet. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows no attacker privileges are needed but the victim must open the file, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Technical ContextAI
The flaw is an integer underflow / wraparound (CWE-191) in the code that parses Excel workbook data. When a length, size, or offset field in a crafted spreadsheet is manipulated so a subtractive computation drops below zero, the value wraps to a very large unsigned number, corrupting subsequent memory allocation or bounds logic and enabling out-of-bounds access that can be steered toward arbitrary code execution. The CPE data confirms the affected code is shared across the entire Office family: Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Office 2019, Office LTSC 2021/2024, Office 365/LTSC for Mac (2021/2024), and Office Online Server - indicating the vulnerable parser is part of the common Office document-handling stack rather than a single build.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for Office referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55039; the input does not list exact patched build numbers, so consult that advisory for the specific version per channel (Click-to-Run/Current, Monthly Enterprise, LTSC MSI, and Mac builds), and update Office Online Server on the server side. As compensating controls until patching completes, open untrusted spreadsheets in Protected View and keep macro and external-content settings locked down (this adds a click/friction cost for legitimate documents), block or quarantine inbound .xls/.xlsx/.xlsb attachments from untrusted senders at the mail gateway (trade-off: may delay legitimate business files), and use Attack Surface Reduction rules and warn-on-open policies to reduce the chance of a user directly opening a weaponized workbook. Because exploitation requires the user to open a file, user awareness training against unexpected spreadsheet attachments is a meaningful supplementary control.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-191 – Integer Underflow
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today