Microsoft Excel EUVD-2026-99072

Exploitation requires a user to open or preview a maliciously crafted Excel spreadsheet in Microsoft Office Excel - the mandatory user interaction (CVSS UI:R) is the primary limiting factor and means this is not a zero-click or self-propagating network attack. No authentication or elevated privileges are needed on the target (PR:N), and no special non-default configuration is indicated by the description; any standard Excel installation that opens the file is potentially affected. Realistic risk is bounded by whether an attacker can socially engineer the victim into opening the file and by email/attachment filtering and Protected View, which can block or sandbox untrusted documents.

This is a genuine high-priority patch item, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw that needs no privileges but does require user interaction - the classic Office document-open code-execution pattern, where a victim opening a malicious Excel file triggers the out-of-bounds read (CWE-20). No EPSS score, CISA KEV listing, or public POC was supplied in the input, so exploitation probability and in-the-wild activity cannot be quantified from the available data; absence of these signals is not evidence they are low. One point of tension worth noting: the weakness is an out-of-bounds READ (typically an information-disclosure primitive), yet Microsoft classifies the impact as remote code execution with full C/I/A impact - this is plausible (an OOB read can leak memory layout or corrupt control flow in a larger exploit chain) but the single MSRC reference is the only source, so the RCE characterization should be taken as vendor-asserted rather than independently corroborated. Overall: treat as a priority for Office/Excel patch cycles given ubiquitous deployment and the proven exploitability of document-open vulnerabilities, while recognizing the user-interaction requirement moderates it below a zero-click network worm.

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a user into opening it. Processing the malformed file triggers an out-of-bounds read in Excel's parsing logic, which Microsoft states can lead to code execution in the context of the current user. No public exploit code was identified in the provided data, and successful attack depends on the victim opening the file (UI:R).