Microsoft Excel EUVD-2026-99730

Exploitation requires a user to open an attacker-crafted Excel document (UI:R); the file can be delivered remotely via email or web download, and no attacker authentication or prior privileges are needed (PR:N). The limiting factors are significant: a human must actively open the malicious spreadsheet, so there is no remote, zero-click, or automated server-side exposure, and impact is confined to information disclosure (memory read) with no integrity or availability effect. No specific non-default Excel configuration is required - any version within the affected ranges (e.g., Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and Office 365 for Mac) is exposed when a crafted file is opened.

This is a medium-severity information-disclosure flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) stemming from an out-of-bounds read (CWE-125) in Microsoft Office Excel. The signals are internally consistent and point to moderate, not critical, priority. The CVSS vector shows network delivery with low complexity and no privileges, but exploitation hinges on required user interaction (UI:R) - a victim must open a malicious Excel file - which is the dominant limiting factor. Impact is confidentiality-only (C:H/I:N/A:N): an OOB read can leak memory contents but cannot alter data or crash the service. CISA's SSVC framework reinforces lower urgency: Exploitation=none (no observed activity), Automatable=no (consistent with UI:R, since mass automated exploitation is impractical when a human must open a file), and Technical Impact=partial. There is no CISA KEV listing and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. No public exploit was identified at time of analysis. The combination - read-only impact, mandatory user interaction, no exploitation evidence - makes this a patch-in-normal-cycle item rather than an emergency, despite the network attack vector. A reasonable limitation: C:H for a single OOB read is generous; real-world leakage is often bounded to adjacent heap/stack memory, so the practical confidentiality impact may be lower than the rating implies.

An attacker crafts a malicious Excel spreadsheet (e.g., XLSX/XLS) and delivers it via email or a web download, relying on social engineering to get the victim to open it. When Excel parses the malformed file, the out-of-bounds read causes it to disclose adjacent process memory - potentially leaking sensitive data or address-layout information useful for chaining with other bugs. No public exploit code was identified at time of analysis, and the required user interaction (opening the file) limits automated, large-scale abuse.