Microsoft Excel EUVD-2026-99809

Exploitation requires the victim to open an attacker-crafted Excel document (UI:R) in an affected build - e.g. Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC/365 for Mac, or Office Online Server below the fixed versions listed in EUVD-2026-99809. No authentication or pre-existing privileges on the target are needed (PR:N), and no special non-default configuration is indicated. The primary limiting factor is the mandatory user interaction: the attack cannot succeed without a user opening the malicious file, and Protected View / Mark-of-the-Web sandboxing on files from untrusted sources further constrains real-world exploitation.

This is a genuine high-priority vulnerability, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated code-execution flaw whose only brake is required user interaction - the victim must open a malicious Excel document. This is the classic Office client-side RCE profile, consistent with the description ('execute code over a network') and CWE-121 (stack-based buffer overflow). No EPSS score was provided, so exploitation probability cannot be quantified from the input. The vulnerability is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or available exploit code at time of analysis - this materially lowers immediate risk relative to a KEV-listed bug. The signals are internally consistent (no CVSS-vs-description conflict), but note that UI:R means real-world exploitation depends on social engineering rather than fully autonomous spread, so this is unlikely to be wormable. Treat as a priority patch due to Excel's enormous footprint and HIGH triple impact, but absent KEV/POC/EPSS data it does not warrant drop-everything emergency response over other patched, non-exploited client-side flaws.

An attacker crafts a malicious Excel spreadsheet that triggers a stack-based buffer overflow when parsed, then delivers it via phishing email, a shared drive, or a download link. When the targeted user opens the file in a vulnerable version of Excel, the overflow overwrites the stack and executes attacker-controlled code in the context of the user. No public exploit code or active exploitation is identified at time of analysis.