Microsoft Excel EUVD-2026-99823

Exploitation requires the victim to open an attacker-crafted Excel workbook in a vulnerable build of Microsoft Office Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac, or Office Online Server versions below the fixed releases listed in EUVD-2026-99823); the double free is triggered during file parsing. The primary limiting factor is the required user interaction (UI:R) - the attack does not fire automatically and depends on social engineering to get the target to open the document - and exploitation yields code execution only at the privilege level of the user who opened the file. No special server configuration is needed; default Excel installations that process the malicious file are affected.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-deliverable, low-complexity, unauthenticated code-execution flaw whose only brake is required user interaction (UI:R) - the victim must open a malicious workbook. This is the classic Office file-parsing RCE risk profile: not a wormable server-side bug, but highly weaponizable via phishing. No EPSS probability, CISA KEV entry, or POC indicator is present in the supplied data, so exploitation likelihood cannot be quantified and there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' The SSVC/exploitation signals are therefore absent rather than conflicting. Given Excel's enormous install base and Microsoft's own reporting of the issue, this should be treated as a real patch priority driven by product prevalence and impact, not by confirmed in-the-wild activity. NOTE: the input Tag 'Authentication Bypass' contradicts the actual weakness (CWE-415 double free leading to RCE) and appears mislabeled - do not treat this as an authentication-bypass vulnerability.

An attacker emails a crafted .xlsx/.xls workbook to a target and lures them into opening it in a vulnerable Excel build. Parsing the malicious file triggers a double free (CWE-415), corrupting heap memory and allowing arbitrary code execution in the context of the user who opened the document. No public exploit code is identified in the available data, so this reflects the designed attack path rather than an observed campaign.