EUVD-2026-44191
GHSA-6236-c2c5-2j6c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no prior auth (PR:N); successful overflow yields full code execution in user context, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (and the broader Office 2016/2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server family) results from a stack-based buffer overflow triggered when a victim opens a maliciously crafted spreadsheet. An attacker who convinces a user to open a booby-trapped file can run arbitrary code in the context of that user, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the ubiquity of Excel and Microsoft's own advisory make this a routine patch-Tuesday-class priority.
Technical ContextAI
The root cause is CWE-121 (Stack-based Buffer Overflow): Excel's file parser copies attacker-controlled data from a crafted workbook into a fixed-size stack buffer without adequate bounds checking, allowing the return address or adjacent stack data to be overwritten and control flow to be hijacked. The affected component is the Office/Excel document parsing engine shared across many packaging channels, as confirmed by the CPE set spanning microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021/2024, and their Mac LTSC equivalents, plus office_online_server. Because the same parsing logic is packaged into desktop, Mac, and server-side (Office Online Server) products, a single malformed file format flaw propagates across the entire Office estate rather than a single SKU.
RemediationAI
Patch available per vendor advisory - apply Microsoft's security update for CVE-2026-55141 via the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55141, ensuring updates reach every channel in use (Microsoft 365 Apps, Office 2016/2019, LTSC 2021/2024, Office for Mac, and Office Online Server), since the same flaw spans all of them. Exact fixed build numbers are not included in the provided input, so pull them from that advisory rather than guessing. Until updates are deployed, reduce exposure by enabling Protected View and Block Macros/Mark-of-the-Web enforcement so files from the internet open in a sandboxed, read-only state, and consider Attack Surface Reduction rules that block Office from spawning child processes - the trade-off is that Protected View can disrupt legitimate workflows that rely on immediate editing of downloaded spreadsheets, and strict ASR rules can break add-ins or automation. Restricting or blocking inbound .xls/.xlsx attachments at the mail gateway for untrusted senders further limits the delivery path at the cost of some user friction.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today