Microsoft Excel EUVD-2026-99724

Exploitation requires the victim to open an attacker-crafted Excel document (workbook), which triggers an out-of-bounds read during file parsing (CWE-125) - this user-interaction requirement (UI:R) is the primary limiting factor and prevents automated, wormable exploitation. No authentication or prior privileges are required (PR:N), and the attack is deliverable over a network (e.g., emailed or downloaded file), but it cannot succeed against a user who does not open the malicious file. Affected builds include Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, and Microsoft 365 Apps for Enterprise (fixed build not clearly specified in the provided EUVD data). Impact is limited to information disclosure (confidentiality only); there is no code-execution, integrity, or availability effect.

Signals are consistent and point to a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw whose sole gating factor is required user interaction - i.e., a victim must open a crafted Excel file. The CISA SSVC framework reinforces a low operational urgency: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with the UI:R requirement, since mass drive-by automation is impractical when a human must open a document), and Technical Impact=partial (matching confidentiality-only impact with no integrity or availability loss). This is NOT in CISA KEV and no POC is referenced, so there is no confirmed active exploitation. No EPSS score was provided in the input, so the empirical exploitation-probability signal is simply absent rather than low. Net: a credible but second-tier vulnerability - a vendor-patched, confidentiality-only client-side bug that should be remediated on a normal Patch-Tuesday cadence, not treated as an emergency. The 'Buffer Overflow' tag mildly overstates the mechanism; CWE-125 is an out-of-bounds read (memory over-read / info leak), not a memory-corruption overflow write, which is itself consistent with the I:N/A:N (no integrity/availability) impact.

An attacker crafts a malicious Excel workbook that triggers an out-of-bounds read in Excel's file parser and delivers it to a target via phishing email or a web download. When the victim opens the document, Excel reads memory beyond an intended buffer, and the leaked data (potentially sensitive heap contents) can be disclosed to the attacker. No public exploit identified at time of analysis, and successful exploitation hinges on the victim actively opening the file (UI:R).