EUVD-2026-44206
GHSA-2xhx-8hwj-hj2c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-borne client-side RCE: AV:L and UI:R because the victim must open a crafted file, PR:N as no auth is needed, and C/I/A:H reflecting full code execution in the user's context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Arbitrary code execution in Microsoft Office Excel arises from a heap-based buffer overflow (CWE-122) that an attacker triggers when a victim opens a maliciously crafted spreadsheet, running code in the security context of the current user. The flaw spans a broad Office footprint including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office editions, and Office Online Server. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 7.8 rating reflects high impact gated by required user interaction.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-122), a memory-corruption class where a parser writes past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or object pointers that can be steered into controlled code execution. In this case the vulnerable component is Microsoft Excel's file/format parsing logic, which processes attacker-controlled spreadsheet content. The CPE set confirms the affected surface is the Excel application across the Office family: cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024, and office_online_server - indicating both Windows and macOS builds plus server-side rendering are in scope. Because CVSS scope is Unchanged (S:U), impact is confined to the process/user context executing Excel.
RemediationAI
Apply the Microsoft security update for CVE-2026-55131 across all affected Office channels; the input confirms a patch is available from the vendor, so this is the primary and preferred fix - Patch available per vendor advisory. Exact fixed build numbers are not included in the provided data, so obtain them from the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55131 and ensure Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server are all updated. Where patching cannot be completed immediately, reduce exposure by enabling Protected View and Office macro/file-block policies for files originating from the internet and email, which forces untrusted spreadsheets into a sandboxed read-only mode before parsing (trade-off: users must click to enable editing, adding friction for legitimate documents), and by using attachment filtering to quarantine spreadsheet files from untrusted senders (trade-off: may delay legitimate business files). These are mitigations that lower likelihood of a user opening a weaponized file but do not remove the underlying overflow, so patching remains required.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today