Microsoft Excel EUVD-2026-99827

Exploitation requires a user to open an attacker-crafted Excel document in a vulnerable build of Microsoft Office Excel (CVSS UI:R) - there is no unauthenticated, zero-interaction remote path. The crafted workbook must reach the victim (typically via email attachment, download, or shared link) and be opened in an affected product/version: Office Online Server before 16.0.10417.20228, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and the Mac LTSC 2021/2024 and Office 365 for Mac builds listed by EUVD. The primary limiting factor is the mandatory user interaction (opening the file, and defeating Protected View / Mark-of-the-Web warnings); patched builds and configurations that block untrusted documents from opening in edit mode materially reduce exposure. No authentication to the target is required (PR:N), and the attacker needs no pre-existing access.

This is a genuine high-priority issue, though not a drop-everything emergency on exploitation-signal grounds alone. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated code-execution flaw whose single gating factor is user interaction (UI:R) - i.e. a victim must open a malicious Excel workbook. Heap-based buffer overflows (CWE-122) in Office file parsers are historically among the most reliably weaponized Microsoft bugs and frequently appear in phishing and commodity-malware campaigns. However, exploitation signals are currently weak-to-absent: no EPSS score, KEV status, SSVC decision, or POC was provided in the input, so there is no confirmed active exploitation and no public exploit identified at time of analysis. The practical risk is therefore driven by the combination of trivial complexity, no authentication, extremely broad deployment of Excel, and the low bar of a user opening an attachment - a classic phishing-lure profile - rather than by any confirmed in-the-wild activity. Note one caveat to verify: Microsoft assigns AV:N to file-format RCEs even though delivery realistically depends on social-engineering the victim into opening a file, so the 'network' vector should be read as 'malicious document delivered over a network/email,' not an unattended remote service exploit.

An attacker emails a victim a crafted .xlsx/.xls workbook (or hosts it on a link) that triggers a heap buffer overflow in Excel's parsing code when opened. On open, the overflow corrupts heap memory and the attacker achieves arbitrary code execution in the user's security context. No public exploit code was identified in the provided data, but the low attack complexity makes reliable weaponization plausible once internals are known.