EUVD-2026-44190
GHSA-q8g8-h36v-wcv9
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open RCE: AV:L and UI:R because the victim must open a crafted spreadsheet, PR:N as no prior privileges are needed, and C/I/A:H from full code execution in the user's context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Arbitrary local code execution in Microsoft Office Excel (spanning Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the Office for Mac editions, and Office Online Server) lets an attacker run code in the current user's context when a victim opens a maliciously crafted spreadsheet. The flaw is an untrusted pointer dereference (CWE-822) triggered during file parsing; it requires user interaction but no prior privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open an attacker-supplied malicious Excel document - the CVSS vector's UI:R (user interaction required) and AV:L (local) confirm the attacker cannot trigger this remotely without that action. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.8 (High), vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local vector, low complexity, no privileges, mandatory user interaction, and high impact to confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker emails a finance employee a crafted spreadsheet (or hosts it on a shared drive or web link) engineered to make Excel dereference an attacker-controlled pointer during parsing. When the victim opens the file and, if prompted, exits Protected View, memory corruption occurs and the attacker's code runs with that user's privileges, enabling data theft or a foothold for lateral movement. … |
| Remediation | Patch available per vendor advisory - apply the Microsoft security updates in the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55136 as the primary fix, via Microsoft Update / Click-to-Run for 365 Apps and the matching LTSC, Mac, and Office Online Server packages; take exact patched build numbers from that advisory rather than assuming them. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a rapid inventory of all Microsoft Office installations across the organization and identify high-value systems (finance, accounting, executive) where spreadsheet-based attacks pose the greatest risk; simultaneously issue guidance to all users to exercise caution when opening unsolicited spreadsheets and to report suspicious file sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and the macOS editions) arises
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Office (including Microsoft 365 Apps for Enterprise, Office 2016/2019, and Office LTSC
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Local arbitrary code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and O
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office for Mac 2021/2024)
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today