Microsoft Excel EUVD-2026-99828

Exploitation requires a user to open an attacker-crafted Excel document (CVSS UI:R) in an affected build of Microsoft Office Excel - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server below the fixed versions. No authentication or pre-existing privileges on the target are needed (PR:N), and no special non-default product configuration is required to trigger the integer underflow in the file parser. The key limiting factors are the mandatory user interaction and Office's built-in mitigations: Protected View and Mark-of-the-Web sandboxing block the exploit until the user explicitly enables editing/content, so the realistic risk is tied to social-engineering success rather than silent remote compromise.

This is a genuine patching priority despite relying on user interaction. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a low-complexity, unauthenticated vector requiring one user action, with full compromise of confidentiality, integrity, and availability in the victim's security context. The 'over a network' / AV:N framing is the standard Microsoft Office file-delivery model rather than a server-side auto-exploit: the UI:R component means a user must open a crafted Excel document, which is the primary limiting factor and the reason this is not a wormable, zero-click issue. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by the product's enormous deployment footprint and the proven effectiveness of malicious-Office-document phishing, not by any observed in-the-wild signal. Note a minor source discrepancy: the description states 'integer underflow' (conceptually CWE-191) while the assigned CWE is CWE-122 (heap-based buffer overflow) and tags cite Heap Overflow; these are consistent if the underflow drives an undersized heap allocation that is then overflowed, but the root-cause label should be verified against the MSRC advisory.

An attacker crafts a malicious Excel workbook that triggers an integer underflow leading to heap corruption in Excel's file parser, then delivers it via phishing email, a shared drive, or a web download. When the victim opens the file (and bypasses or lacks Protected View / Mark-of-the-Web mitigations), the memory corruption is leveraged to execute arbitrary code in the context of the current user. No public exploit code was identified in the provided intelligence.