Microsoft Excel EUVD-2026-99830

Exploitation requires a user to open an attacker-supplied, specially crafted Excel file in Microsoft Office Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, and Office/Office LTSC for Mac 2021/2024 per EUVD); the use-after-free is triggered during document parsing. The decisive limiting factor is the required user interaction (UI:R) - there is no server-side or zero-click path indicated, so the attacker depends on social engineering to get the victim to open the file. Protected View, Mark-of-the-Web blocking, and disabling of document preview reduce real-world exploitability. No authentication on the target is needed (PR:N), and the attacker needs no prior access, but code executes only in the context of the user who opens the file.

This is a genuine high-priority patch item, though not a drop-everything emergency absent exploitation evidence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-deliverable, low-complexity, unauthenticated memory-corruption flaw (CWE-416 use-after-free) whose only meaningful gate is user interaction (UI:R) - a victim must open a malicious Excel document. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified from the data supplied; there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore internally consistent (all point to a weaponizable client-side RCE) but incomplete: the severity is driven by impact and reach, not by demonstrated exploitation. Office file-format use-after-frees are historically a favored vector for phishing-delivered RCE, so defenders should treat the 8.8 as credible rather than inflated, while noting the UI:R requirement meaningfully limits mass, hands-off exploitation. EPSS, KEV, and POC status are all MISSING from the input and should be verified against CISA KEV and threat feeds before finalizing prioritization.

An attacker emails a victim a specially crafted Excel spreadsheet (or hosts it on a web page/share) and lures them into opening it in a vulnerable version of Microsoft Office Excel. Parsing the malicious file triggers a use-after-free, corrupting memory so the attacker can execute arbitrary code in the context of the user. No public exploit code was identified in the provided data; exploitation requires the user to open the file (UI:R).