Microsoft Excel EUVD-2026-99811

Exploitation requires a user to open or preview an attacker-crafted Excel workbook in an affected build of Microsoft Office Excel (LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office for Mac, or Office Online Server). The required user interaction (UI:R) is the key limiting factor: the attack cannot fire without victim action, making phishing and social engineering the realistic delivery path. No authentication is needed (PR:N) and code executes in the context of the opening user rather than with elevated privileges. Despite the AV:N label there is no indication of a server-side or auto-triggering network vector.

This is a genuine patch-now priority for environments running Microsoft Excel. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes an unauthenticated, low-complexity network-vector use-after-free with high confidentiality, integrity and availability impact, mitigated only by required user interaction (UI:R). In practice this is a client-side file-open bug rather than a server-reachable service flaw, so the AV:N label overstates remote reachability - exploitation realistically requires luring a user to open a crafted workbook rather than attacking a listening service. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no confirmed active exploitation: no public exploit identified at time of analysis. The combination of a ubiquitous product, a memory-corruption RCE class (CWE-416), and an available vendor patch means this should still be prioritized despite the absence of exploitation telemetry, since UAF bugs in Office are historically attractive phishing payloads.

An attacker crafts a malicious Excel workbook that triggers a use-after-free condition and delivers it via phishing email or a download link. When the victim opens the file, reuse of the freed object is manipulated to execute attacker-controlled code in the context of the current user. No public exploit code is identified in the available data, and successful exploitation depends on the victim opening the file (UI:R).