EUVD-2026-99818
GHSA-8qr3-4pvw-39jm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via phishing
-
DeliveryVictim opens file in Excel
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code in user context
-
ImpactCompromise host and data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open or preview a specially crafted Excel spreadsheet in a vulnerable Office/Excel build (UI:R); it is not triggerable against a passive or default-running service without that interaction. No authentication to the target is needed (PR:N) and no special non-default configuration is indicated - any affected version listed in the EUVD data (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Office Online Server, Office 365 for Mac) that opens the malicious file is at risk. The primary limiting factor is the mandatory user action of opening the file, which Protected View / Mark-of-the-Web mitigations and user caution can disrupt. |
| Impact | Multiple signals align on genuine but conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw with full confidentiality/integrity/availability impact, but the UI:R requirement means a user must open a malicious Excel file - this is not a wormable, zero-click issue. EPSS score is not provided in the input, and CISA KEV status is absent (no KEV listing), so there is no evidence of active exploitation; likewise no POC/exploit code is referenced. SSVC parameters were not supplied. The combination - high technical impact but mandatory user interaction, a vendor patch already available, and no confirmed exploitation or public POC - makes this a 'patch promptly but not emergency' item rather than a confirmed active-exploitation priority. Note a common labeling tension for file-format Office RCEs: Microsoft rates AV:N because the malicious document is delivered over a network (email/web), yet the actual trigger is local file opening; defenders should treat the realistic vector as phishing/document delivery, not direct network service exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious Excel spreadsheet that triggers a heap-based buffer overflow (CWE-122) and emails or hosts it for a target. When the victim opens the file in a vulnerable Office/Excel build, the overflow corrupts heap memory and allows arbitrary code execution in the user's context. No public exploit code is identified at time of analysis, and the attack depends on the victim opening the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.
RemediationAI
Apply the vendor patch: update Microsoft 365 Apps for Enterprise through the Office Security Releases channel (https://aka.ms/OfficeSecurityReleases) to the latest build; Office LTSC 2021 to 16.0.14334.20974 or later; Office LTSC 2024 to 16.0.17932.21056 or later; Office Online Server to 16.0.10417.20228 or later; and the Mac editions (Office LTSC for Mac 2021/2024 and Office 365 for Mac) per Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97758. Until patching is complete, retain and enforce Protected View and Mark-of-the-Web for documents from untrusted sources, avoid opening or previewing unsolicited Excel attachments (disable Outlook attachment preview handlers where business processes permit), and consider blocking risky file types at email and web gateways - noting these controls reduce but do not eliminate exposure and may disrupt legitimate spreadsheet workflows. Because no non-default configuration is required for exploitation, patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-122 (heap-based buffer overflow) in Microsoft Office Excel's handling of spreadsheet content: a crafted file triggers an out-of-bounds write to heap memory, which can corrupt adjacent allocations and, given a suitable heap layout, redirect execution flow to attacker-controlled data. The assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows the attack is delivered over a network (for example, an email attachment, web download, or shared file), requires no privileges on the target, leaves scope unchanged, and depends on the victim opening or previewing the file. Excel's parsers execute in the security context of the opening user, so successful exploitation grants that user's code-execution privileges; Mark-of-the-Web and Protected View are the primary mitigations capable of disrupting parsing. The ENISA EUVD entry EUVD-2026-99818 tracks the same defect across Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Microsoft Office 365 for Mac, and Office Online Server builds.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file delivered over network (AV:N) but triggered only when the user opens it (UI:R); no privileges needed (PR:N) and code execution yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Excel - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and its Mac editions, Microsoft Office 365 for Mac, and Office Online Server - contains a memory-corruption flaw that allows an attacker to run malicious code on a victim's device once a crafted spreadsheet is opened or previewed. The attack requires only a convincing document and no credentials, so any employee who routinely handles files from outside the organization is a potential entry point into the corporate environment. Leadership should treat this as a workforce-wide endpoint exposure that demands coordinated, prioritized patching rather than isolated IT remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB