Microsoft Excel EUVD-2026-99810

Exploitation requires a user to open an attacker-supplied, specially crafted Excel file (UI:R) in an affected version of Microsoft Excel / Office (e.g., Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the macOS Office builds listed). No authentication or pre-existing privileges on the target are needed (PR:N), and it works against default configurations - there is no special feature or setting toggle called out. The principal limiting factor is the mandatory user interaction: the victim must be socially engineered into opening the malicious document, and code executes only in that user's security context (S:U), not with elevated privileges. Protected View / Mark-of-the-Web sandboxing on files from the internet is a practical mitigating control.

This is a credible, patch-worthy priority but not a drop-everything emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a client-side remote code execution with no privileges required but mandatory user interaction (UI:R) - the 'network' attack vector reflects Microsoft's convention for malicious-document delivery (email/web/share) rather than a listening service, so exploitation hinges on a user opening a crafted Excel file. No EPSS score is provided, and there is no CISA KEV listing and no public proof-of-concept in the supplied data, so this is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The combination of high technical impact plus required user interaction places this in the 'patch promptly' tier typical of monthly Office RCE fixes: dangerous because Excel is universal and social engineering reliably satisfies UI:R, but mitigated by the lack of observed exploitation and the user-interaction barrier. Key missing signals to note explicitly: EPSS probability is absent (cannot quantify likelihood), and exploitation status is unconfirmed - treat active-exploitation claims as absent, not refuted.

An attacker emails or hosts a specially crafted Excel spreadsheet (e.g., a fake invoice or report) and lures a victim into opening it. Parsing the malformed file triggers a heap-based buffer overflow (CWE-122) in Excel, allowing arbitrary code execution in the context of the logged-on user. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to open the file (UI:R).