EUVD-2026-52536
GHSA-vr7p-v768-gfhg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File delivered over the network with no attacker privileges required, but active user document-open interaction is necessary; full RCE yields high C/I/A with no scope change beyond the Excel process.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution via use-after-free in Microsoft Excel affects multiple product lines including Microsoft 365 Apps for Enterprise, Excel 2016, and Office 2019/LTSC 2021/LTSC 2024. An unauthenticated remote attacker can exploit this memory corruption flaw by convincing a target user to open a specially crafted Excel workbook, resulting in arbitrary code execution under the context of the victim process. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, no-privilege network attack vector makes it an attractive phishing payload candidate.
Technical ContextAI
CWE-416 (Use After Free) describes a class of memory safety vulnerabilities in which a program continues to reference heap-allocated memory after it has been freed, allowing an attacker to control the reuse of that memory region and redirect execution flow. In Excel's parsing and rendering engine, a maliciously structured workbook can trigger such a condition, leading to heap corruption and ultimately arbitrary code execution. The CPE strings confirm five distinct affected software configurations: cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise:*:*:*:*:*:*:*:*, cpe:2.3:a:microsoft:microsoft_excel_2016:*:*:*:*:*:*:*:*, cpe:2.3:a:microsoft:microsoft_office_2019:*:*:*:*:*:*:*:*, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021:*:*:*:*:*:*:*:*, and cpe:2.3:a:microsoft:microsoft_office_ltsc_2024:*:*:*:*:*:*:*:*. The breadth of affected product lines indicates the vulnerable code path exists across multiple Excel codebases maintained in parallel by Microsoft.
RemediationAI
Apply the vendor-released patch per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62870. Patch availability is confirmed by Microsoft; however, exact fixed build version numbers are not independently confirmed from the provided input data and must be verified in the MSRC advisory directly. For Microsoft 365 Apps for Enterprise, ensure automatic updates are enabled and channel builds are current. For perpetual-license products (Excel 2016, Office 2019, Office LTSC 2021/2024), apply the relevant cumulative update from Microsoft Update Catalog or WSUS. As a compensating control where immediate patching is not possible, configure Microsoft Protected View to enforce read-only opening of Excel files received from external sources and untrusted locations - this adds a required additional user action before the exploit-triggering rendering path executes, reducing likelihood of successful exploitation, though it does not eliminate the underlying vulnerability. Additionally, email gateway policies blocking or sandboxing inbound Excel attachments with macros or external data connections can reduce delivery success.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today