Microsoft Office Excel EUVD-2026-99888

Exploitation requires the victim to open an attacker-supplied Excel file (UI:R confirmed in the CVSS vector) in an affected build of Microsoft Office Excel - specifically Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, or the corresponding Office/Office LTSC for Mac editions per EUVD-2026-99888. No authentication is required (PR:N) and no special target configuration is needed, so default installations are vulnerable. The primary LIMITING factor is the mandatory user interaction: the attack fails unless a user is socially engineered into opening the malicious document, which also prevents automated/wormable mass exploitation (SSVC Automatable: no). Code executes only with the privileges of the user who opens the file, not elevated.

This is a credible high-priority vulnerability but not an emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-reachable, unauthenticated code execution with total CIA impact, tempered only by required user interaction (UI:R) - consistent with the classic Office pattern where a victim must open a malicious Excel file. The SSVC decision framework partially disagrees with the raw score: it rates Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no' (user interaction breaks any mass-automation chain), while agreeing that Technical Impact is 'total'. There is no CISA KEV listing and no POC indicated in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was supplied, which is a data gap for probabilistic prioritization. Net: a genuinely dangerous memory-corruption RCE in an extremely widespread product, but one gated behind social engineering and currently without evidence of active exploitation - patch promptly as part of normal high-severity triage rather than as a zero-day fire drill. Note the AV:N classification is standard-but-indirect for file-based Office flaws: the 'network' vector really means the malicious document is delivered remotely (e.g., email) and opened locally, not a remotely-triggerable listening service - verify this framing against the MSRC advisory.

An attacker crafts a malicious Excel spreadsheet that triggers a heap-based buffer overflow (CWE-122) and emails it to a target or hosts it for download. When the victim opens the file in a vulnerable version of Microsoft Office Excel, the overflow corrupts heap memory and the attacker's code executes in the user's security context. No public exploit code has been identified at the time of analysis.