Microsoft Excel EUVD-2026-99815

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel spreadsheet in an affected Office build (per EUVD: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office for Mac variants). The limiting factor is mandatory user interaction (UI:R) - the overflow is not reachable without a user opening the malicious document, so purely automated remote exploitation against an idle target is not possible. Code executes in the context of the current user (S:U, no privilege escalation), so a non-administrative user account limits direct system-level impact. Protected View / Office hardening and attachment-blocking controls further reduce real-world exploitability.

This is a genuine high-priority patching candidate, though not a drop-everything emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity, unauthenticated code execution with full confidentiality/integrity/availability impact - but the UI:R flag is decisive: exploitation requires a victim to open a malicious Excel document, which is the dominant real-world attack pattern for Office file-format bugs (phishing with weaponized attachments). No EPSS score, KEV listing, or POC availability was supplied in the input, so there is currently no evidence of active exploitation or public exploit code; this tempers the raw 8.8. However, Office memory-corruption RCE bugs historically attract exploit development and are frequently weaponized post-patch via diffing, and the ubiquity of Excel makes the eventual exploitation surface enormous. No SSVC decision data was provided. Signals are internally consistent (network vector tempered by required user interaction); the main gap is the absence of exploitation-probability telemetry (EPSS/KEV/POC all unknown rather than confirmed-negative).

An attacker emails a victim a specially crafted Excel spreadsheet (e.g., as a phishing attachment or malicious download link). When the victim opens the file, a heap-based buffer overflow in Excel's parsing logic is triggered, allowing the attacker to execute arbitrary code in the context of the user. No public proof-of-concept or active exploitation was identified in the provided intelligence.