What is the CVSS score of EUVD-2026-56757?

EUVD-2026-56757 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Excel are affected by EUVD-2026-56757?

Microsoft Office Excel users can be compromised by opening a specially crafted spreadsheet, bypassing all normal security boundaries and granting an attacker full system access.. A patch is available.

How to fix or mitigate EUVD-2026-56757?

Immediately within 24 hours: communicate vulnerability details to all users, disable macro execution in Excel organization-wide, and instruct staff to avoid opening Excel files from untrusted sources or unexpected senders. Within 7 days: implement email gateway rules to filter suspicious Excel attachments and validate that endpoint detection systems can monitor for CVE-2026-68803 exploitation attempts; catalog recent Excel file receipts for forensic review. Within 30 days: establish a monitoring program for Microsoft security advisories to enable rapid patch deployment once released; evaluate alternative solutions for mission-critical spreadsheet workflows or restrict Excel to read-only sandboxed environments pending patch release.

Microsoft Excel EUVD-2026-56757

| CVE-2026-68803 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-08-11 secure@microsoft.com

GHSA-3gc6-9vg4-vj89

Authentication Bypass Memory Corruption Microsoft 365 Apps Excel Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

AV:L and UI:R reflect file-borne delivery; PR:N because no attacker credentials needed; full C/I/A:H for arbitrary code execution in user context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:07 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Type confusion (CWE-843) in Microsoft Office Excel enables local code execution by an unauthenticated attacker when a victim opens a specially crafted Excel document. The CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a file-borne attack requiring user interaction but no attacker privileges, with full High/High/High C/I/A impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the memory corruption tag suggests the type confusion leads to exploitable heap or stack corruption.

Technical ContextAI

CWE-843 (Type Confusion) occurs when software accesses a memory resource using an incompatible type - for example, treating a pointer to one struct as a pointer to a different struct, causing out-of-bounds reads or writes. In Microsoft Excel's context, this likely resides in the spreadsheet file parser or formula engine, where object metadata is misinterpreted under specific malformed-document conditions. Excel's COM/OLE-based object model and its complex formula evaluation engine are historically rich attack surfaces for type confusion. The vulnerability is reported by secure@microsoft.com (MSRC), indicating it originated through Microsoft's internal or coordinated disclosure process. No CPE strings were provided, so exact affected versions are not independently confirmable from this dataset.

RemediationAI

Apply the Microsoft security update addressing CVE-2026-68803, available through the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68803. No exact patched version number was present in the available data - consult the MSRC page for the specific KB article or build version. An exact fix version has not been independently confirmed from this dataset. As a compensating control where patching is not immediately possible, organizations can restrict the ability to open Excel files from untrusted sources by enabling Microsoft Office Protected View and Attack Surface Reduction (ASR) rules targeting Office document macros and child process spawning. Deploying Mark-of-the-Web (MOTW) propagation and blocking Excel from spawning child processes via Defender for Endpoint policies reduces exploitation impact, though neither prevents the initial memory corruption trigger.