Microsoft Excel EUVD-2026-99817

Exploitation requires the victim to open an attacker-crafted Excel document in Microsoft Office Excel (UI:R in the CVSS vector) - it is not triggerable purely over the network without user action. No authentication is required of the attacker (PR:N), and default configurations are affected since the flaw is in Excel's handling of workbook content. Limiting factors: the attacker must socially engineer a user into opening the file, Protected View / Mark-of-the-Web sandboxing may block or warn on files downloaded from untrusted sources, and only the listed affected builds (e.g., Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, and 365 Apps for Enterprise/Mac editions) are vulnerable. Code executes in the context of the opening user, so least-privilege accounts constrain post-exploitation impact.

This is a genuine high-priority patch-worthy issue but not an emergency at the time of analysis. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact - however the UI:R (user interaction required) component is decisive and means this is not a wormable, self-propagating threat: a victim must open a malicious Excel file. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active exploitation or available exploit code. The absence of EPSS and KEV data means widespread-exploitation probability cannot be quantified from the provided signals; this contrasts with the high CVSS base score, which reflects worst-case impact rather than observed exploitation. Office memory-corruption bugs of this class (CWE-416 use-after-free) are historically attractive to phishing and targeted-intrusion actors once a patch is reverse-engineered, so the practical risk is driven by patch-diffing timelines and user susceptibility to malicious attachments rather than by remote network exposure alone. Note the input Tags include 'Denial Of Service,' which conflicts with the description and impact metrics indicating remote code execution - the availability impact exists but the primary consequence is code execution, not merely DoS.

An attacker crafts a malicious Excel spreadsheet that triggers a use-after-free in Microsoft Excel's parsing/rendering logic and delivers it via phishing email, a shared document, or a web download. When the victim opens the file (UI:R), the dangling-pointer condition is exploited to execute arbitrary code in the context of the user. No public proof-of-concept or exploit code is referenced in the available data.