EUVD-2026-56466
GHSA-4x7r-w35q-cr5x
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-delivered exploit requires no privileges (PR:N) but mandates user interaction to open the document (UI:R); full code execution yields C:H/I:H/A:H within the unchanged user scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a crafted file. The vulnerability (CWE-121) is triggered through user interaction with malicious content, requiring no privileges on the target system beyond access to run Excel. No public exploit code or CISA KEV listing is identified at time of analysis, though the high-impact CVSS 7.8 score reflects full compromise of confidentiality, integrity, and availability upon successful exploitation.
Technical ContextAI
CWE-121 (Stack-based Buffer Overflow) describes a condition where a program writes more data to a stack-allocated buffer than it can hold, overwriting adjacent memory including return addresses or function pointers. In Microsoft Excel, this occurs during parsing or processing of a maliciously crafted file. The attack vector is local (AV:L), consistent with file-based exploitation - the attacker delivers a weaponized Excel document that triggers the overflow when the application processes its contents. The affected product is Microsoft Office Excel, as reported by secure@microsoft.com and referenced via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68816.
RemediationAI
The primary remediation is to apply the vendor-released security update for Microsoft Office Excel via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68816. An exact patched version number was not provided in the available intelligence - confirm the specific update KB article via the MSRC portal. While awaiting patching, compensating controls include configuring Microsoft Office Protected View to open files from email and internet sources in read-only sandboxed mode (enabled by default in many configurations; verify via Group Policy), blocking delivery of Excel file formats (.xls, .xlsx, .xlsm, .xlsb) at the email gateway where operationally feasible, and enabling Attack Surface Reduction rules in Microsoft Defender for Endpoint to block Office applications from creating child processes. Note that blocking file types at the gateway may disrupt legitimate business workflows and should be scoped carefully.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today