Microsoft Excel EUVD-2026-99820

Exploitation requires a user to open a maliciously crafted Excel document (UI:R in the CVSS vector) - the flaw is not reachable without victim interaction, which is the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and no special server-side configuration is required; the vulnerable code path is the standard Excel file-parsing routine present in default installations. Affected products per EUVD include Microsoft Office LTSC 2024 (before 16.0.17932.21056), Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC for Mac 2021/2024, so both Windows and macOS Office builds are in scope. The attack vector is 'network' in the sense that the malicious file is delivered remotely (email/web), but code execution occurs locally when the file is opened, running in the context of the current user rather than as SYSTEM/root.

This is a genuine high-priority client-side vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated code-execution flaw whose only gating factor is user interaction (UI:R) - i.e., a victim must open a crafted Excel document. This is the archetypal phishing/malicious-attachment attack surface, which attackers routinely weaponize. However, several threat-intel signals that would confirm imminent mass exploitation are ABSENT from the input: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV, and no public POC is indicated. Therefore, per the precision rules, exploitation status is 'no public exploit identified at time of analysis' - this is high real-world risk by nature of the product and vector, but there is no evidence of active exploitation at this time. The signals are internally consistent (no conflict between CVSS and description; both indicate remote, user-interaction-gated RCE), so the main caveat is simply that dynamic exploitation metrics (EPSS/KEV/POC) are unavailable to refine urgency. A patch is confirmed available from the vendor, so remediation is actionable now.

An attacker crafts a malicious Excel spreadsheet that triggers a stack-based buffer overflow (CWE-121) in Microsoft Office Excel's file parsing and delivers it via phishing email or a download link. When the targeted user opens the file, the overflow corrupts the stack and executes attacker-controlled code in the context of the user. No public exploit code is identified at time of analysis, but the AV:N/AC:L/UI:R profile makes this a practical, low-effort phishing payload.