EUVD-2026-56758
GHSA-pr9p-842j-v7hq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing vulnerability triggered locally (AV:L); no privileges needed by attacker (PR:N); victim must open the file (UI:R); full code execution yields C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system impact when a victim opens a maliciously crafted workbook. The root cause is a numeric truncation error (CWE-122) in Excel's file parsing logic, where an integer value is truncated before being used to size a heap allocation, resulting in an undersized buffer that can be overflowed. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, but the high CVSS score of 7.8 and full confidentiality, integrity, and availability impact make this a meaningful risk for organizations relying on Excel file workflows.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) describes a condition where a program writes past the end of a buffer allocated on the heap. The description attributes the root cause to a numeric truncation error - a class of bug (related to CWE-197) where a larger integer type is assigned to a smaller one, silently discarding high-order bits and producing an unexpectedly small value. When that truncated value drives a heap allocation size calculation in Excel's file parser, the resulting buffer is smaller than the data subsequently written into it, triggering the heap overflow. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the vulnerability is triggered locally during file parsing (AV:L), requires no special privileges on the part of the attacker (PR:N), but does require the victim to actively open a crafted file (UI:R). The affected product is Microsoft Office Excel; no specific CPE string or affected version range was provided in the input data.
RemediationAI
Apply the Microsoft security update addressing CVE-2026-68804 as published in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68804. No specific patched version number was included in the provided intelligence data, so the exact fix version cannot be cited here - consult the MSRC advisory directly for the applicable update for your Office or Microsoft 365 channel. As a compensating control prior to patching, organizations should enforce Protected View and disable automatic macro execution via Group Policy, which limits the immediate code execution surface for file-based attacks; note that Protected View can be bypassed by users who dismiss warnings, so it is not a complete mitigation. Blocking delivery of Excel file formats (.xlsx, .xlsm, .xlsb, .xls) at the email gateway for high-risk user populations is a higher-assurance workaround with the trade-off of disrupting legitimate file workflows. Microsoft Defender Attack Surface Reduction rules targeting Office child process creation can reduce post-exploitation pivot potential even if the overflow itself fires.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today