Microsoft Excel EUVD-2026-52536

Exploitation requires a target user to open a specially crafted Microsoft Excel file delivered by the attacker - this is the sole prerequisite imposed by the UI:R CVSS metric. No authentication to any service is required from the attacker's side (PR:N), and no special Excel configuration or non-default feature needs to be enabled. The vulnerability is reachable via the standard Excel document parsing code path. Exploitation is limited by the requirement that a user actively open the malicious file; automated, unauthenticated network scanning cannot trigger this vulnerability without user interaction. Affected scope is limited to users running one of the five confirmed product configurations (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024) on any supported platform; the CPE entries do not restrict by operating system.

The CVSS 3.1 base score of 8.8 (High) reflects a network-reachable, low-complexity attack requiring no privileges but needing user interaction (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with full confidentiality, integrity, and availability impact. The UI:R requirement is the primary risk-reduction factor, limiting fully automated, wormable exploitation - however, in practice, Office documents delivered via phishing or drive-by downloads represent one of the most reliable and prevalent initial access mechanisms in enterprise threat environments, making this a realistic and actionable risk despite the interaction requirement. No EPSS score was provided in the input data, so exploitation probability cannot be quantified precisely. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified at time of analysis, suggesting active exploitation has not been widely observed yet. The vendor temporal metrics (E:U/RL:O/RC:C) in the provided vector corroborate this: unproven exploitability, official fix released, confirmed by vendor. Overall assessment: this is a genuine priority for organizations running any of the five affected product configurations, particularly those with high phishing exposure, but it is not yet a crisis-tier actively exploited vulnerability.

An attacker crafts a malicious Excel workbook engineered to trigger the use-after-free condition in Excel's document parsing engine and distributes it via a phishing email or compromised file-sharing link targeting employees of an organization running a vulnerable Office product. When the victim opens the file, the freed memory is reallocated and controlled by the attacker, redirecting execution flow to attacker-supplied shellcode and establishing a foothold under the victim's user account. No public proof-of-concept has been identified at time of analysis, but the low attack complexity rating (AC:L) suggests that once developed, weaponization of this vulnerability would be straightforward.