Microsoft Excel EUVD-2026-99726

Exploitation requires the victim to open a specially crafted Excel workbook in a vulnerable Office build (UI:R) - this user-interaction requirement is the primary limiting factor and the reason SSVC rates the flaw non-automatable. No authentication or prior access is needed (PR:N), and it is network-deliverable (AV:N) via email attachment, web download, or shared file. Affected configurations include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the macOS Office editions listed in EUVD, prior to the fixed builds. Preview-pane or Protected View handling may reduce but does not inherently eliminate exposure; defenders should treat any workflow that opens untrusted spreadsheets as at-risk until patched.

This is a genuine high-priority vulnerability, though not the top of the triage queue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction - consistent with the classic Office exploitation model where a victim must open a malicious workbook. Technical impact is total (C:H/I:H/A:H), confirmed by SSVC's 'Technical Impact: total' rating and CWE-122 heap overflow enabling arbitrary code execution. However, the risk signals are not uniformly alarming: SSVC reports 'Exploitation: none' and 'Automatable: no', no CISA KEV listing is present, and no public POC is indicated, so there is currently no evidence of in-the-wild abuse. The 'Automatable: no' rating aligns with the UI:R requirement - mass, hands-off exploitation is impractical because each compromise needs a user to open a crafted file. In short: high severity and a vendor patch is available, but the absence of active exploitation and the user-interaction dependency place this as an important-to-patch issue rather than an emergency drop-everything scenario. Given Excel's ubiquity and attacker familiarity with Office file-format bugs, weaponization over time is plausible, so prompt patching is warranted.

An attacker crafts a malicious Excel workbook that triggers the heap-based buffer overflow and delivers it via phishing email or a download link. When the targeted user opens the file in a vulnerable Office/Excel build, the overflow corrupts heap memory and executes attacker-controlled code in the user's security context. No authentication is required (PR:N), but the attack fails unless the victim actually opens the file (UI:R); no public exploit code has been identified at time of analysis.