Microsoft Excel EUVD-2026-99825

Exploitation requires the victim to open a maliciously crafted Excel document (CVSS UI:R), delivered via email attachment, web download, or a shared link; it is not a zero-click or server-side flaw. No authentication is required of the attacker (PR:N), and default Office configurations are affected - but Protected View / Office hardening, blocking of files from the internet (Mark-of-the-Web), and user caution on opening untrusted spreadsheets all meaningfully limit real-world exploitation. The core limiting factor is the mandatory user interaction of opening the file; without that, the chain does not fire.

This is a genuine high-priority vulnerability, though not the top tier of urgency given the absence of exploitation signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a classic client-side remote code execution pattern in Microsoft Office Excel: network-reachable delivery, low attack complexity, no privileges required, but crucially User Interaction Required (UI:R) - the victim must open a crafted file. The full C:H/I:H/A:H impact triad confirms complete compromise of the Office process context. No EPSS probability was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active or imminent widespread exploitation at this time. The signals are therefore internally consistent (a vendor-reported memory-corruption RCE with a patch available) rather than conflicting: the 8.8 is driven by impact and ease once a file is opened, tempered by the UI:R dependency that prevents fully automatic, zero-click spread. Office UAF flaws historically become exploitation targets after patch release, so this warrants prompt patching even without current KEV status. SSVC framing is not supplied in the input and cannot be asserted.

An attacker emails a weaponized Excel spreadsheet (or hosts it on a web/SharePoint link) to a target and uses social engineering to get the victim to open it. When opened, the file triggers a use-after-free in Excel's memory handling, allowing the attacker to execute arbitrary code in the context of the user running Office. No public exploit code was identified at the time of analysis.