EUVD-2026-56754
GHSA-xvfh-c22c-fv36
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L reflects file-based exploitation requiring local document open; PR:N because no prior account privilege is needed; UI:R because victim must open the crafted workbook.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/PR:N/UI:R) confirms exploitation requires no prior privileges but depends on user interaction - consistent with a malicious document delivery scenario. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a high-severity concern for any environment running unpatched Excel installations.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) identifies the root cause: Excel's document parsing routines write beyond the bounds of a heap-allocated buffer when processing a malformed file. Heap overflows in office productivity parsers are well-understood exploitation targets because heap memory is attacker-influenceable, making controlled overwrites feasible. Microsoft Office Excel is the affected product per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68798); no CPE strings were supplied in the input, so exact build or version ranges cannot be enumerated from available data alone. The attack surface is the Excel file-parsing engine, activated whenever a user opens a crafted workbook.
RemediationAI
Apply the Microsoft security update published for CVE-2026-68798 via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68798. No specific fixed version number was provided in the available intelligence data, so the exact target patch version should be confirmed from the MSRC advisory before deployment. As an interim compensating control, organizations can restrict opening of Excel files from untrusted or external sources by enforcing Protected View policies in Office Trust Center settings, which sandboxes document parsing and reduces the risk of full code execution - note this may affect workflow for users who routinely open external attachments. Additionally, enabling Microsoft Defender's attack surface reduction rules targeting Office macro and script execution provides layered defense, though it does not directly block file-parsing heap overflows.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today