Office Online Server
Monthly
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Opening or previewing an attacker-supplied Excel spreadsheet can allow a remote, unauthenticated attacker to run code in the security context of the user who opened the file on affected Windows and macOS Office builds (Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and the corresponding Mac editions). The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so while delivery is remote via email or web, exploitation is gated by user interaction - the victim must open the crafted document - and the resulting impact is bounded by that user's privileges. No public exploit code has been identified at time of analysis and the vendor has released patches, so this is a patching-priority item rather than a confirmed actively exploited or wormable remote flaw.
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.
Heap-based buffer overflow in Microsoft Office Excel lets a remote, unauthenticated attacker execute code when a victim opens or previews a specially crafted Excel workbook in an affected Office build. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/SU/C:H/I:H/A:H means the attacker needs the user to interact with the malicious file, not a server-side or fully unauthenticated service exploit, despite the network attack-vector label. Microsoft has released patches per the MSRC advisory; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute code by convincing a user to open a specially crafted Excel file. Exploitation requires user interaction and can be blocked by Protected View, but the high impact (CVSS 8.8) makes patching a high priority even though no public exploit has been identified at the time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of a victim user by convincing them to open a crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming no attacker credentials are needed but requiring user interaction (opening the file, typically via phishing or a malicious download); the code executes with the victim's privileges, so a low-privileged account limits the immediate impact. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and LTSC for Mac, Office 365 for Mac, and Office Online Server below patched versions like 16.0.14334.20974, 16.0.17932.21056, and 16.0.10417.20228, and no public exploit or KEV listing is confirmed at time of analysis.
Out-of-bounds read in Microsoft Excel enables remote code execution (CVSS 8.8) when a user opens or previews a specially crafted workbook, requiring user interaction (UI:R) but no attacker authentication (PR:N). Affected products include Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365/LTSC for Mac, Office Online Server, and SharePoint Server Subscription Edition builds prior to vendor-fixed versions, so server-side document rendering can broaden exposure. No public exploit identified at time of analysis, and vendor patches are available; the primary limiting factor is the required user action.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code in the context of the user who opens a maliciously crafted workbook, with the file delivered over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office LTSC for Mac; no public exploit identified at time of analysis, and vendor patches remove the condition.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.
Use-after-free in Microsoft Excel enables remote code execution when a victim opens an attacker-crafted workbook; the attacker needs no authentication (PR:N) but must convince the user to open the file (UI:R), as reflected in the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation runs code in the context of the opening user with high confidentiality, integrity, and availability impact, and default Excel configurations on the listed builds are affected. Vendor patches are available with specific fix builds (e.g., 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.0.10417.20228 for Office Online Server), and no public exploit code was identified at time of analysis, making this a genuine high-priority patch-worthy issue but not an emergency at the time of analysis.
Heap-based buffer overflow in Microsoft Excel (CWE-122) lets an unauthenticated attacker execute arbitrary code in the context of the victim's user account when that user opens a specially crafted spreadsheet; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects full confidentiality, integrity and availability impact but is gated by mandatory user interaction. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so both endpoint document handling and server-side file rendering are in scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but with a vendor patch already published it is a high-priority patching candidate for environments that routinely open externally sourced Office files rather than a drop-everything emergency.
Stack-based buffer overflow in Microsoft Excel enables remote code execution against affected builds when a victim opens an attacker-crafted spreadsheet; the memory-corruption flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or prior access are needed, but successful exploitation hinges entirely on the target user opening the malicious document. Exposure spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, Office LTSC 2021/2024 and Office 365 for Mac, and Office Online Server running builds below the fixed versions enumerated in ENISA EUVD-2026-99809. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a vendor fix through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750), which keeps this a high-priority but manageable patch-now item rather than an emergency.
Heap-based buffer overflow in Microsoft Excel enables remote attackers to execute code on a victim's machine with the privileges of the affected Office process by convincing a user to open or preview a specially crafted workbook (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Because the vector shows PR:N, no credentials or elevated privileges are needed, but the UI:R requirement means the bug cannot self-propagate and depends on social engineering to deliver and open the malicious file across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server, all of which have vendor-supplied fixes. Microsoft has published a security update (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748), and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven by unpatched, high-exposure Office deployments and phishing-delivered workbooks rather than by an observed campaign.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code by convincing a victim to open a maliciously crafted Excel file. This use-after-free vulnerability (CWE-416) affects multiple Excel versions, including Office LTSC 2024, Office LTSC 2021, and Office Online Server, with a CVSS score of 8.8. No public exploit or active exploitation has been identified, and while it is not a zero-click emergency, patching is strongly recommended.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted spreadsheet, because an integer underflow (CWE-191) in Office's document handling wraps a value and leads to memory corruption exploitable for code execution in the context of the opening user. No authentication is required on the target (PR:N) and the file can be delivered over the network via email, a link, or a shared document, but exploitation depends on the victim opening the file (UI:R), and no server-side or zero-click path is indicated. Microsoft has released fixed builds (for example Office LTSC 2021 16.0.14334.20974 and Office LTSC 2024 16.0.17932.21056), and no public exploit identified at time of analysis; treat this as a high-priority, patch-worthy issue rather than an emergency given the absence of exploitation signals.
Remote code execution in Microsoft Excel can be triggered by a stack-based buffer overflow when a victim opens a specially crafted workbook, allowing arbitrary code in the context of the opening user. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac variants, and Office Online Server; the attack is network-deliverable (AV:N) and requires no authentication (PR:N) but depends on user interaction (UI:R) to open the file. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Office Excel is possible when an unauthenticated attacker convinces a user to open a crafted spreadsheet in an unpatched build, with the underlying flaw being an integer underflow/wraparound in the document parser that corrupts memory. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server below their fixed builds; exploitation requires the user to open and enable content in the malicious document (CVSS UI:R) but needs no credentials or pre-existing privileges on the target (PR:N). No public exploit was identified at time of analysis, and Microsoft has released fixed builds, so this is a genuine patching priority even though the attack hinges on user interaction and is substantially blunted by Protected View and Mark-of-the-Web sandboxing.
Remote code execution in Microsoft Excel stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated attacker can trigger by convincing a victim to open a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server, with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicating low-complexity, network-delivered exploitation that requires no attacker credentials but does require the victim to open the malicious file. Successful exploitation yields code execution in the security context of the user who opened the document, and while no public exploit has been identified at time of analysis, the flaw is vendor-confirmed, rated 8.8, carries an official Microsoft patch, and is considered a credible, actionable priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code in the context of the user who opens or previews a specially crafted workbook, affecting Microsoft Office LTSC 2021 and 2024, Microsoft 365 Apps for Enterprise, Office for Mac, and Office Online Server. The attack requires user interaction (UI:R) and no authentication (PR:N), with code executing at the user's privilege level rather than elevated; phishing or social engineering is the realistic delivery path. A vendor patch is available, and no public exploit has been identified at time of analysis.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and the corresponding Mac builds) is possible when an unauthenticated attacker convinces a victim to open a specially crafted Excel workbook. The root cause is a use-after-free (CWE-416) memory-corruption condition that the crafted file triggers inside Excel's parsing/handling logic, giving the attacker code execution in the context of the user, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The decisive limiting factor is mandatory user interaction: there is no zero-click or server-side trigger in the assessed vector, and no public exploit code has been identified at time of analysis. Vendor patches are available, and the MSRC update guide should be treated as the authoritative reference.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine if the user opens a specially crafted spreadsheet that triggers a buffer underwrite (CWE-124) in Excel's file-parsing path. The flaw carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is fully remote with no privileges required, but the mandatory user interaction (UI:R) is the key limiting factor - the attack cannot fire unless the malicious workbook is opened, so Protected View, Mark-of-the-Web enforcement and user awareness materially reduce real-world exposure. Affected software covers Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021 on Windows and Mac, and Office Online Server; vendor patches are available per Microsoft's advisory, and no public exploit was identified at time of analysis. By signal convergence this is a genuine high-priority vulnerability, but with no confirmed active exploitation and an interaction prerequisite it is not an emergency.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Office for Mac. Exploitation requires user interaction (UI:R) and no public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code when a victim opens or previews a crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. No public exploit code has been identified at time of analysis, but the CVSS score of 8.8 and low attack complexity make this a credible, actionable priority; vendor patches are available. Code execution occurs in the context of the user who opens the file, and user interaction is required.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code in the context of the opening user when a crafted workbook is opened or previewed (user interaction required). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 for Windows and Mac, Office 365 for Mac, and Office Online Server. No public exploit has been identified at time of analysis, and Microsoft has released patches; risk is high but not a top-tier emergency given the reliance on social engineering.
Out-of-bounds read in Microsoft Excel allows a remote, unauthenticated attacker to execute arbitrary code when a victim opens a maliciously crafted spreadsheet. The vulnerability requires user interaction (CVSS UI:R) and stems from improper input validation (CWE-20); successful exploitation can fully compromise confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score (8.8) and the lack of a confirmed fixed version in the provided data make this a high-priority patching item.
Remote code execution in Microsoft Excel allows an unauthorized attacker to execute arbitrary code when a victim opens a crafted spreadsheet, per the vendor advisory for CVE-2026-100212. The issue is a use-after-free (CWE-416) reachable over the network with no privileges required (AV:N/PR:N), but exploitation is gated by user interaction (UI:R) and runs in the security context of the user who opens the file (S:U). No public exploit identified at time of analysis, and the independent assessment rates it a credible prioritization candidate but not an emergency.
Heap-based buffer overflow in Microsoft Excel enables an unauthenticated, remote attacker to execute arbitrary code in the context of the victim user, provided the victim opens or previews a specially crafted Excel workbook (CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation depends on social engineering to deliver the malicious file, and default Office protections such as Protected View and Mark-of-the-Web meaningfully reduce real-world risk. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and signals are moderately strong but not top-tier urgent.
Out-of-bounds read (CWE-125) in Microsoft Office Excel's file-parsing engine enables local code execution when a victim opens a specially crafted spreadsheet. Affects a wide range of Microsoft Office products from version 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, on both Windows and Mac platforms. No public exploit identified at time of analysis, but the low attack complexity combined with full confidentiality, integrity, and availability impact makes phishing-delivered document lures a realistic and proven delivery vector.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span nearly every current Office release line - Excel 2016, Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office Online Server. An attacker who tricks a user into opening a malicious workbook can achieve full code execution at the victim's privilege level, with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Local code execution in Microsoft Office Excel (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) allows an attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted spreadsheet. The flaw stems from use of an uninitialized resource (CWE-908) and carries a CVSS 7.8; it requires user interaction (opening the file) and no prior privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Local code execution in Microsoft Excel (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) allows an attacker to run arbitrary code when a victim opens a maliciously crafted spreadsheet. The flaw is a heap-based buffer overflow (CWE-122) triggered during file parsing, giving full confidentiality, integrity, and availability impact in the user's context. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation currently appears theoretical rather than active.
Information disclosure in Microsoft Excel (across Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds heap memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process memory. The flaw (CWE-125, CVSS 7.1) requires local user interaction and no privileges, but is not remotely triggerable without the user opening the file. There is no public exploit identified at time of analysis, EPSS is low at 0.30%, and CISA SSVC rates exploitation as none.
Arbitrary code execution in Microsoft Office Excel arises from a use-after-free (CWE-416) memory-corruption flaw affecting Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server. The CVSS 3.1 vector (AV:L/UI:R) makes this a user-interaction-dependent, locally-scoped issue: a victim must open a maliciously crafted Excel workbook, after which the attacker gains code execution in the user's security context. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
Arbitrary code execution in Microsoft Office Excel arises from a heap-based buffer overflow (CWE-122) that an attacker triggers when a victim opens a maliciously crafted spreadsheet, running code in the security context of the current user. The flaw spans a broad Office footprint including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office editions, and Office Online Server. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 7.8 rating reflects high impact gated by required user interaction.
Information disclosure in Microsoft Office Excel (2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process data such as memory contents, pointers, or credentials. Rated CVSS 7.1 with a local attack vector requiring user interaction, the flaw stems from a CWE-125 out-of-bounds read in Excel's file parser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of Excel and Microsoft's confirmed patch make prompt patching important.
Local code execution in Microsoft Excel arises from a heap-based buffer overflow (CWE-122) that an attacker triggers by luring a victim into opening a maliciously crafted spreadsheet, yielding attacker code in the user's security context. It affects a broad Office family including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS editions, and Office Online Server. The CVSS 3.1 base score is 7.8 and the vector requires user interaction (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Microsoft Office Excel (across Microsoft 365 Apps, Office 2016/2019, LTSC 2021/2024, Office for Mac, and Office Online Server) stems from a heap-based buffer overflow (CWE-122) that an attacker triggers when a victim opens a maliciously crafted spreadsheet. Rated CVSS 7.8 with no privileges required but mandatory user interaction, successful exploitation yields full confidentiality, integrity, and availability impact in the context of the victim user. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but Microsoft has released a patch.
Local code execution in Microsoft Office Excel (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, Office Online Server) arises from an out-of-bounds read (CWE-125) that an attacker weaponizes by luring a victim into opening a crafted spreadsheet, yielding code execution in the user's security context. The flaw carries a CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) and requires no privileges but does require user interaction. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Microsoft Excel (spanning Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) allows an unauthorized attacker to run code in the victim's context by tricking them into opening a maliciously crafted spreadsheet. The flaw is a heap-based buffer overflow (CWE-122) that executes with the local user's privileges once the file is opened. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) arises from an out-of-bounds read (CWE-125) triggered when a victim opens a maliciously crafted spreadsheet. CVSS 7.8 with high impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis. Exploitation requires user interaction (opening the file) but no prior authentication or privileges on the target beyond the ability to induce the user to open the document.
Local arbitrary code execution in Microsoft Excel arises from a buffer over-read (CWE-126) triggered when a victim opens a maliciously crafted spreadsheet, letting an attacker run code in the context of the current user. The flaw spans Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024 (Windows and Mac) and Office Online Server; a vendor patch is available via MSRC. No public exploit has been identified at time of analysis, and the CVSS 7.8 (AV:L/UI:R) rating reflects that user interaction is required.
Local code execution in Microsoft Excel (and the broader Office 2016/2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server family) results from a stack-based buffer overflow triggered when a victim opens a maliciously crafted spreadsheet. An attacker who convinces a user to open a booby-trapped file can run arbitrary code in the context of that user, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the ubiquity of Excel and Microsoft's own advisory make this a routine patch-Tuesday-class priority.
Arbitrary local code execution in Microsoft Office Excel (spanning Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the Office for Mac editions, and Office Online Server) lets an attacker run code in the current user's context when a victim opens a maliciously crafted spreadsheet. The flaw is an untrusted pointer dereference (CWE-822) triggered during file parsing; it requires user interaction but no prior privileges. No public exploit is identified at time of analysis, and a vendor patch is available from Microsoft (MSRC).
Local code execution in Microsoft Excel (and the broader Office family including Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) stems from a heap-based buffer overflow that triggers when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker gains full code execution in the victim's context but only after the target opens the file. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available from Microsoft (MSRC CVE-2026-55041).
Local code execution in Microsoft Excel (and the broader Office suite through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from an integer underflow (CWE-191) in Excel's file parsing, letting an attacker run arbitrary code in the context of the user who opens a maliciously crafted spreadsheet. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows no attacker privileges are needed but the victim must open the file, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Arbitrary code execution in Microsoft Excel (across Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a heap-based buffer overflow (CWE-122) that triggers when a victim opens a maliciously crafted spreadsheet. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local, user-interaction-dependent file-format attack rather than a remote network exploit, yielding code execution in the context of the current user. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV; a Microsoft patch is available.
Local code execution in Microsoft Excel (spanning Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office builds, and Office Online Server) arises from an integer overflow (CWE-190) triggered when the application parses a maliciously crafted spreadsheet. An unauthorized attacker who convinces a victim to open a booby-trapped file can run arbitrary code in the context of the current user, with full confidentiality, integrity, and availability impact per the 7.8 CVSS vector. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local code execution in Microsoft Office Excel (spanning Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, the macOS builds, and Office Online Server) arises from an out-of-bounds read (CWE-125) that an attacker triggers by convincing a user to open a maliciously crafted workbook. The CVSS 3.1 base score is 7.8 with high confidentiality, integrity, and availability impact, but exploitation requires user interaction (opening the file) and no active exploitation or public proof-of-concept has been reported. There is no public exploit identified at time of analysis; Microsoft has released a patch via its Security Update Guide.
Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a type-confusion flaw (CWE-843) in how Excel parses spreadsheet content. An attacker who convinces a victim to open a malicious workbook can run arbitrary code in the context of the current user, gaining high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Microsoft Excel (Office 2016 through LTSC 2024, Microsoft 365 Apps, and Mac editions) allows an attacker to run arbitrary code by tricking a user into opening a maliciously crafted spreadsheet that triggers a type-confusion condition in Excel's file parser. The CVSS 3.1 score is 7.8 (High) with the local vector reflecting file-open exploitation rather than remote-network access, and success requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Microsoft Office Excel (across Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and their macOS equivalents) arises from a use-after-free (CWE-416) memory-corruption flaw triggered when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can achieve full confidentiality, integrity, and availability impact but requires the victim to open a file, making it a classic phishing-delivered client-side bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Excel memory-corruption bugs are historically attractive targets.
Local arbitrary code execution in Microsoft Excel arises from a heap-based buffer overflow (CWE-122) triggered when a user opens a maliciously crafted spreadsheet; successful exploitation runs attacker code in the context of the current user across desktop Office builds (Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps) on both Windows and Mac, as well as Office Online Server. The flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact but requires user interaction (opening the file). No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available from Microsoft.
Local code execution in Microsoft Excel (2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption (CWE-416) that an attacker triggers when a victim opens a maliciously crafted spreadsheet. Exploitation runs code in the context of the current user and requires user interaction (opening the file), with no public exploit identified at time of analysis. This is a locally-exploited, phishing-delivered class of bug typical of Office file-format handlers, patched by Microsoft via MSRC.
Local code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from a stack-based buffer overflow (CWE-121) triggered when a user opens a maliciously crafted spreadsheet. An attacker who convinces a victim to open the file runs arbitrary code in the security context of the current user, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; Microsoft has released a patch.
Local code execution in Microsoft Excel (including Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted spreadsheet, letting an attacker run arbitrary code in the user's context. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that exploitation needs user interaction but no prior privileges once the file is opened. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch.
Local code execution in Microsoft Office Excel results from an integer underflow (CWE-122 heap-based) that allows an unauthorized attacker to run arbitrary code in the context of the user opening a crafted spreadsheet. The CVSS 7.8 score reflects local attack vector with required user interaction, and no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the originating CNA, and the issue is tagged as a buffer/heap overflow class flaw.
Local code execution in Microsoft Office Excel stems from an integer underflow that, when triggered by opening a crafted spreadsheet, allows an attacker to run arbitrary code in the context of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation requires the victim to open a malicious file, and there is no public exploit identified at time of analysis. With a base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation effectively gives the attacker the victim's privileges on the host.
Information disclosure in Microsoft Office Excel allows remote unauthenticated attackers to read out-of-bounds memory over a network, potentially exposing sensitive data from process memory. The CVSS 8.2 score reflects high confidentiality impact with no authentication or user interaction required per the CVSS vector. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Local code execution in Microsoft Office Excel stems from an integer underflow condition that can be triggered when a victim opens a malicious spreadsheet, leading to out-of-bounds memory access (CWE-125). The flaw requires user interaction but no prior authentication on the target, and no public exploit identified at time of analysis. With a CVSS of 7.8 (high) and the typical phishing-friendly delivery model of Office files, this fits the profile of a document-based client-side RCE primitive.
Local code execution in Microsoft Office Excel can be achieved by an unauthenticated attacker who tricks a user into opening a malicious spreadsheet that triggers an integer underflow condition. The flaw carries a CVSS 7.0 rating reflecting high attack complexity and required user interaction, and no public exploit identified at time of analysis. There is a notable mismatch between the description (integer underflow) and the assigned CWE-362 (race condition), which warrants verification with Microsoft's advisory.
Local code execution in Microsoft Office Excel arises from an integer underflow condition that corrupts memory when a malicious spreadsheet is opened. The flaw requires user interaction (UI:R) to trigger but needs no prior authentication, enabling attackers to run arbitrary code in the security context of the victim user. At the time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019, LTSC 2021/2024, Office for Mac, and Office Online Server) is possible when a user opens a maliciously crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122), running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%, 18th percentile), but the technical impact is total (full confidentiality, integrity, and availability loss). Microsoft has released patches; exploitation requires the victim to open a file, so it is a phishing/social-engineering-driven local vulnerability rather than a remotely wormable one.
Local code execution in Microsoft Office Excel (Excel 2016, Office 2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a specially crafted spreadsheet. Successful exploitation yields full compromise of the current user's context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none, indicating this is a patch-in-cycle issue rather than an active threat.
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Microsoft Excel use-after-free vulnerability (CWE-416) enables arbitrary code execution when a user opens a specially crafted Excel file. Affects Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. CVSS 7.8 (High) requires local access and user interaction but no authentication. No public exploit identified at time of analysis. Microsoft released patches addressing all affected product lines per MSRC update guide.
Use-after-free vulnerability in Microsoft Office Excel enables local code execution when users open maliciously crafted Excel files. Affects all major Office versions including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. Attack requires no authentication (PR:N) but demands user interaction (opening a weaponized document). CVSS 7.8 (High) reflects significant impact potential (code execution with high confidentiali
Use-after-free memory corruption in Microsoft Excel across Office 2016-2024 and Microsoft 365 enables local code execution when a user opens a malicious spreadsheet. Attackers must craft a weaponized Excel file and trick users into opening it, after which arbitrary code runs with the victim's privileges. No authentication is required, though user interaction is necessary. Exploitation probability remains moderate (CVSS 7.8) with no confirmed active exploitation (no CISA KEV listing) and no publi
Microsoft Excel memory corruption via use-after-free enables arbitrary code execution when victims open malicious spreadsheet files. This vulnerability affects all major Office deployments including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, and Office LTSC 2021/2024 for both Windows and macOS, as well as Office Online Server. Attackers require user interaction to open a crafted file, but no authentication is needed (CVSS PR:N), making this exploitable through phishing or file-sharing attacks. Vendor patches are available through Microsoft Security Response Center. No public exploit or active exploitation confirmed at time of analysis, though the straightforward attack vector (local file + user click) and high impact (code execution with full system privileges) warrant prompt patching.
Out-of-bounds read vulnerability (CWE-125) in Microsoft Excel allows local attackers to disclose sensitive memory contents and cause denial of service through maliciously crafted spreadsheet files with user interaction. Affects Microsoft Office 2016/2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server across Windows and macOS platforms. CVSS 7.1 reflects high confidentiality and availability impact with low attack complexity but requires local access and user interaction. No public exploit identified at time of analysis. Vendor-released patches available through Microsoft Security Response Center covering all affected Office product lines.
Microsoft Excel and Office products are vulnerable to local code execution through unsafe pointer dereferencing, requiring user interaction to trigger. An attacker with local access can exploit this flaw to achieve arbitrary code execution with full system privileges. No patch is currently available, leaving users of affected Office versions at risk.
Arbitrary code execution in Microsoft Office Excel and related products (Office Online Server, 365 Apps) via out-of-bounds memory read allows local attackers to achieve complete system compromise without requiring user interaction or elevated privileges. This high-severity vulnerability affects multiple Microsoft Office components and currently lacks a security patch. An attacker with local access can exploit memory corruption to execute malicious code with full system permissions.
Heap buffer overflow in Microsoft Office Excel enables local code execution with high integrity and confidentiality impact affecting Office, Office Online Server, and 365 Apps. An attacker with user interaction can achieve arbitrary code execution in the context of the affected application. No patch is currently available for this vulnerability.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]
Privilege escalation in Microsoft Office Excel (including 365 Apps and Long Term Servicing Channel) via heap-based buffer overflow allows local attackers with user interaction to gain elevated system privileges. The vulnerability affects multiple Office product lines and currently lacks a security patch. With a CVSS score of 7.8, this poses a significant risk to organizations using affected Excel versions.
Arbitrary code execution in Microsoft Office Excel results from an integer underflow vulnerability in the Long Term Servicing Channel and Online Server editions, exploitable by local attackers with user interaction. This HIGH severity flaw (CVSS 7.8) grants full system compromise capabilities including code execution, data theft, and service disruption with no available patch.
Arbitrary code execution in Microsoft Excel through unsafe pointer handling enables local attackers to achieve full system compromise without requiring elevated privileges. This vulnerability affects Microsoft 365 Apps, Office, Office Online Server, and Office Long Term Servicing Channel across multiple versions. No patch is currently available, leaving affected systems vulnerable to exploitation via maliciously crafted spreadsheets.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Opening or previewing an attacker-supplied Excel spreadsheet can allow a remote, unauthenticated attacker to run code in the security context of the user who opened the file on affected Windows and macOS Office builds (Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and the corresponding Mac editions). The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so while delivery is remote via email or web, exploitation is gated by user interaction - the victim must open the crafted document - and the resulting impact is bounded by that user's privileges. No public exploit code has been identified at time of analysis and the vendor has released patches, so this is a patching-priority item rather than a confirmed actively exploited or wormable remote flaw.
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.
Heap-based buffer overflow in Microsoft Office Excel lets a remote, unauthenticated attacker execute code when a victim opens or previews a specially crafted Excel workbook in an affected Office build. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/SU/C:H/I:H/A:H means the attacker needs the user to interact with the malicious file, not a server-side or fully unauthenticated service exploit, despite the network attack-vector label. Microsoft has released patches per the MSRC advisory; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute code by convincing a user to open a specially crafted Excel file. Exploitation requires user interaction and can be blocked by Protected View, but the high impact (CVSS 8.8) makes patching a high priority even though no public exploit has been identified at the time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of a victim user by convincing them to open a crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming no attacker credentials are needed but requiring user interaction (opening the file, typically via phishing or a malicious download); the code executes with the victim's privileges, so a low-privileged account limits the immediate impact. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and LTSC for Mac, Office 365 for Mac, and Office Online Server below patched versions like 16.0.14334.20974, 16.0.17932.21056, and 16.0.10417.20228, and no public exploit or KEV listing is confirmed at time of analysis.
Out-of-bounds read in Microsoft Excel enables remote code execution (CVSS 8.8) when a user opens or previews a specially crafted workbook, requiring user interaction (UI:R) but no attacker authentication (PR:N). Affected products include Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365/LTSC for Mac, Office Online Server, and SharePoint Server Subscription Edition builds prior to vendor-fixed versions, so server-side document rendering can broaden exposure. No public exploit identified at time of analysis, and vendor patches are available; the primary limiting factor is the required user action.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code in the context of the user who opens a maliciously crafted workbook, with the file delivered over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office LTSC for Mac; no public exploit identified at time of analysis, and vendor patches remove the condition.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.
Use-after-free in Microsoft Excel enables remote code execution when a victim opens an attacker-crafted workbook; the attacker needs no authentication (PR:N) but must convince the user to open the file (UI:R), as reflected in the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation runs code in the context of the opening user with high confidentiality, integrity, and availability impact, and default Excel configurations on the listed builds are affected. Vendor patches are available with specific fix builds (e.g., 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.0.10417.20228 for Office Online Server), and no public exploit code was identified at time of analysis, making this a genuine high-priority patch-worthy issue but not an emergency at the time of analysis.
Heap-based buffer overflow in Microsoft Excel (CWE-122) lets an unauthenticated attacker execute arbitrary code in the context of the victim's user account when that user opens a specially crafted spreadsheet; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects full confidentiality, integrity and availability impact but is gated by mandatory user interaction. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so both endpoint document handling and server-side file rendering are in scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but with a vendor patch already published it is a high-priority patching candidate for environments that routinely open externally sourced Office files rather than a drop-everything emergency.
Stack-based buffer overflow in Microsoft Excel enables remote code execution against affected builds when a victim opens an attacker-crafted spreadsheet; the memory-corruption flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or prior access are needed, but successful exploitation hinges entirely on the target user opening the malicious document. Exposure spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, Office LTSC 2021/2024 and Office 365 for Mac, and Office Online Server running builds below the fixed versions enumerated in ENISA EUVD-2026-99809. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a vendor fix through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750), which keeps this a high-priority but manageable patch-now item rather than an emergency.
Heap-based buffer overflow in Microsoft Excel enables remote attackers to execute code on a victim's machine with the privileges of the affected Office process by convincing a user to open or preview a specially crafted workbook (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Because the vector shows PR:N, no credentials or elevated privileges are needed, but the UI:R requirement means the bug cannot self-propagate and depends on social engineering to deliver and open the malicious file across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server, all of which have vendor-supplied fixes. Microsoft has published a security update (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748), and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven by unpatched, high-exposure Office deployments and phishing-delivered workbooks rather than by an observed campaign.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code by convincing a victim to open a maliciously crafted Excel file. This use-after-free vulnerability (CWE-416) affects multiple Excel versions, including Office LTSC 2024, Office LTSC 2021, and Office Online Server, with a CVSS score of 8.8. No public exploit or active exploitation has been identified, and while it is not a zero-click emergency, patching is strongly recommended.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted spreadsheet, because an integer underflow (CWE-191) in Office's document handling wraps a value and leads to memory corruption exploitable for code execution in the context of the opening user. No authentication is required on the target (PR:N) and the file can be delivered over the network via email, a link, or a shared document, but exploitation depends on the victim opening the file (UI:R), and no server-side or zero-click path is indicated. Microsoft has released fixed builds (for example Office LTSC 2021 16.0.14334.20974 and Office LTSC 2024 16.0.17932.21056), and no public exploit identified at time of analysis; treat this as a high-priority, patch-worthy issue rather than an emergency given the absence of exploitation signals.
Remote code execution in Microsoft Excel can be triggered by a stack-based buffer overflow when a victim opens a specially crafted workbook, allowing arbitrary code in the context of the opening user. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac variants, and Office Online Server; the attack is network-deliverable (AV:N) and requires no authentication (PR:N) but depends on user interaction (UI:R) to open the file. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Office Excel is possible when an unauthenticated attacker convinces a user to open a crafted spreadsheet in an unpatched build, with the underlying flaw being an integer underflow/wraparound in the document parser that corrupts memory. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server below their fixed builds; exploitation requires the user to open and enable content in the malicious document (CVSS UI:R) but needs no credentials or pre-existing privileges on the target (PR:N). No public exploit was identified at time of analysis, and Microsoft has released fixed builds, so this is a genuine patching priority even though the attack hinges on user interaction and is substantially blunted by Protected View and Mark-of-the-Web sandboxing.
Remote code execution in Microsoft Excel stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated attacker can trigger by convincing a victim to open a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server, with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicating low-complexity, network-delivered exploitation that requires no attacker credentials but does require the victim to open the malicious file. Successful exploitation yields code execution in the security context of the user who opened the document, and while no public exploit has been identified at time of analysis, the flaw is vendor-confirmed, rated 8.8, carries an official Microsoft patch, and is considered a credible, actionable priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code in the context of the user who opens or previews a specially crafted workbook, affecting Microsoft Office LTSC 2021 and 2024, Microsoft 365 Apps for Enterprise, Office for Mac, and Office Online Server. The attack requires user interaction (UI:R) and no authentication (PR:N), with code executing at the user's privilege level rather than elevated; phishing or social engineering is the realistic delivery path. A vendor patch is available, and no public exploit has been identified at time of analysis.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and the corresponding Mac builds) is possible when an unauthenticated attacker convinces a victim to open a specially crafted Excel workbook. The root cause is a use-after-free (CWE-416) memory-corruption condition that the crafted file triggers inside Excel's parsing/handling logic, giving the attacker code execution in the context of the user, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The decisive limiting factor is mandatory user interaction: there is no zero-click or server-side trigger in the assessed vector, and no public exploit code has been identified at time of analysis. Vendor patches are available, and the MSRC update guide should be treated as the authoritative reference.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine if the user opens a specially crafted spreadsheet that triggers a buffer underwrite (CWE-124) in Excel's file-parsing path. The flaw carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is fully remote with no privileges required, but the mandatory user interaction (UI:R) is the key limiting factor - the attack cannot fire unless the malicious workbook is opened, so Protected View, Mark-of-the-Web enforcement and user awareness materially reduce real-world exposure. Affected software covers Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021 on Windows and Mac, and Office Online Server; vendor patches are available per Microsoft's advisory, and no public exploit was identified at time of analysis. By signal convergence this is a genuine high-priority vulnerability, but with no confirmed active exploitation and an interaction prerequisite it is not an emergency.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Office for Mac. Exploitation requires user interaction (UI:R) and no public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code when a victim opens or previews a crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. No public exploit code has been identified at time of analysis, but the CVSS score of 8.8 and low attack complexity make this a credible, actionable priority; vendor patches are available. Code execution occurs in the context of the user who opens the file, and user interaction is required.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code in the context of the opening user when a crafted workbook is opened or previewed (user interaction required). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 for Windows and Mac, Office 365 for Mac, and Office Online Server. No public exploit has been identified at time of analysis, and Microsoft has released patches; risk is high but not a top-tier emergency given the reliance on social engineering.
Out-of-bounds read in Microsoft Excel allows a remote, unauthenticated attacker to execute arbitrary code when a victim opens a maliciously crafted spreadsheet. The vulnerability requires user interaction (CVSS UI:R) and stems from improper input validation (CWE-20); successful exploitation can fully compromise confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score (8.8) and the lack of a confirmed fixed version in the provided data make this a high-priority patching item.
Remote code execution in Microsoft Excel allows an unauthorized attacker to execute arbitrary code when a victim opens a crafted spreadsheet, per the vendor advisory for CVE-2026-100212. The issue is a use-after-free (CWE-416) reachable over the network with no privileges required (AV:N/PR:N), but exploitation is gated by user interaction (UI:R) and runs in the security context of the user who opens the file (S:U). No public exploit identified at time of analysis, and the independent assessment rates it a credible prioritization candidate but not an emergency.
Heap-based buffer overflow in Microsoft Excel enables an unauthenticated, remote attacker to execute arbitrary code in the context of the victim user, provided the victim opens or previews a specially crafted Excel workbook (CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation depends on social engineering to deliver the malicious file, and default Office protections such as Protected View and Mark-of-the-Web meaningfully reduce real-world risk. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and signals are moderately strong but not top-tier urgent.
Out-of-bounds read (CWE-125) in Microsoft Office Excel's file-parsing engine enables local code execution when a victim opens a specially crafted spreadsheet. Affects a wide range of Microsoft Office products from version 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, on both Windows and Mac platforms. No public exploit identified at time of analysis, but the low attack complexity combined with full confidentiality, integrity, and availability impact makes phishing-delivered document lures a realistic and proven delivery vector.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span nearly every current Office release line - Excel 2016, Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office Online Server. An attacker who tricks a user into opening a malicious workbook can achieve full code execution at the victim's privilege level, with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Local code execution in Microsoft Office Excel (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) allows an attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted spreadsheet. The flaw stems from use of an uninitialized resource (CWE-908) and carries a CVSS 7.8; it requires user interaction (opening the file) and no prior privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Local code execution in Microsoft Excel (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) allows an attacker to run arbitrary code when a victim opens a maliciously crafted spreadsheet. The flaw is a heap-based buffer overflow (CWE-122) triggered during file parsing, giving full confidentiality, integrity, and availability impact in the user's context. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation currently appears theoretical rather than active.
Information disclosure in Microsoft Excel (across Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds heap memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process memory. The flaw (CWE-125, CVSS 7.1) requires local user interaction and no privileges, but is not remotely triggerable without the user opening the file. There is no public exploit identified at time of analysis, EPSS is low at 0.30%, and CISA SSVC rates exploitation as none.
Arbitrary code execution in Microsoft Office Excel arises from a use-after-free (CWE-416) memory-corruption flaw affecting Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server. The CVSS 3.1 vector (AV:L/UI:R) makes this a user-interaction-dependent, locally-scoped issue: a victim must open a maliciously crafted Excel workbook, after which the attacker gains code execution in the user's security context. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
Arbitrary code execution in Microsoft Office Excel arises from a heap-based buffer overflow (CWE-122) that an attacker triggers when a victim opens a maliciously crafted spreadsheet, running code in the security context of the current user. The flaw spans a broad Office footprint including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office editions, and Office Online Server. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 7.8 rating reflects high impact gated by required user interaction.
Information disclosure in Microsoft Office Excel (2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process data such as memory contents, pointers, or credentials. Rated CVSS 7.1 with a local attack vector requiring user interaction, the flaw stems from a CWE-125 out-of-bounds read in Excel's file parser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of Excel and Microsoft's confirmed patch make prompt patching important.
Local code execution in Microsoft Excel arises from a heap-based buffer overflow (CWE-122) that an attacker triggers by luring a victim into opening a maliciously crafted spreadsheet, yielding attacker code in the user's security context. It affects a broad Office family including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS editions, and Office Online Server. The CVSS 3.1 base score is 7.8 and the vector requires user interaction (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Microsoft Office Excel (across Microsoft 365 Apps, Office 2016/2019, LTSC 2021/2024, Office for Mac, and Office Online Server) stems from a heap-based buffer overflow (CWE-122) that an attacker triggers when a victim opens a maliciously crafted spreadsheet. Rated CVSS 7.8 with no privileges required but mandatory user interaction, successful exploitation yields full confidentiality, integrity, and availability impact in the context of the victim user. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but Microsoft has released a patch.
Local code execution in Microsoft Office Excel (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, Office Online Server) arises from an out-of-bounds read (CWE-125) that an attacker weaponizes by luring a victim into opening a crafted spreadsheet, yielding code execution in the user's security context. The flaw carries a CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) and requires no privileges but does require user interaction. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Microsoft Excel (spanning Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) allows an unauthorized attacker to run code in the victim's context by tricking them into opening a maliciously crafted spreadsheet. The flaw is a heap-based buffer overflow (CWE-122) that executes with the local user's privileges once the file is opened. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) arises from an out-of-bounds read (CWE-125) triggered when a victim opens a maliciously crafted spreadsheet. CVSS 7.8 with high impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis. Exploitation requires user interaction (opening the file) but no prior authentication or privileges on the target beyond the ability to induce the user to open the document.
Local arbitrary code execution in Microsoft Excel arises from a buffer over-read (CWE-126) triggered when a victim opens a maliciously crafted spreadsheet, letting an attacker run code in the context of the current user. The flaw spans Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024 (Windows and Mac) and Office Online Server; a vendor patch is available via MSRC. No public exploit has been identified at time of analysis, and the CVSS 7.8 (AV:L/UI:R) rating reflects that user interaction is required.
Local code execution in Microsoft Excel (and the broader Office 2016/2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server family) results from a stack-based buffer overflow triggered when a victim opens a maliciously crafted spreadsheet. An attacker who convinces a user to open a booby-trapped file can run arbitrary code in the context of that user, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the ubiquity of Excel and Microsoft's own advisory make this a routine patch-Tuesday-class priority.
Arbitrary local code execution in Microsoft Office Excel (spanning Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the Office for Mac editions, and Office Online Server) lets an attacker run code in the current user's context when a victim opens a maliciously crafted spreadsheet. The flaw is an untrusted pointer dereference (CWE-822) triggered during file parsing; it requires user interaction but no prior privileges. No public exploit is identified at time of analysis, and a vendor patch is available from Microsoft (MSRC).
Local code execution in Microsoft Excel (and the broader Office family including Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) stems from a heap-based buffer overflow that triggers when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker gains full code execution in the victim's context but only after the target opens the file. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available from Microsoft (MSRC CVE-2026-55041).
Local code execution in Microsoft Excel (and the broader Office suite through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from an integer underflow (CWE-191) in Excel's file parsing, letting an attacker run arbitrary code in the context of the user who opens a maliciously crafted spreadsheet. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows no attacker privileges are needed but the victim must open the file, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Arbitrary code execution in Microsoft Excel (across Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a heap-based buffer overflow (CWE-122) that triggers when a victim opens a maliciously crafted spreadsheet. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local, user-interaction-dependent file-format attack rather than a remote network exploit, yielding code execution in the context of the current user. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV; a Microsoft patch is available.
Local code execution in Microsoft Excel (spanning Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office builds, and Office Online Server) arises from an integer overflow (CWE-190) triggered when the application parses a maliciously crafted spreadsheet. An unauthorized attacker who convinces a victim to open a booby-trapped file can run arbitrary code in the context of the current user, with full confidentiality, integrity, and availability impact per the 7.8 CVSS vector. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local code execution in Microsoft Office Excel (spanning Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, the macOS builds, and Office Online Server) arises from an out-of-bounds read (CWE-125) that an attacker triggers by convincing a user to open a maliciously crafted workbook. The CVSS 3.1 base score is 7.8 with high confidentiality, integrity, and availability impact, but exploitation requires user interaction (opening the file) and no active exploitation or public proof-of-concept has been reported. There is no public exploit identified at time of analysis; Microsoft has released a patch via its Security Update Guide.
Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a type-confusion flaw (CWE-843) in how Excel parses spreadsheet content. An attacker who convinces a victim to open a malicious workbook can run arbitrary code in the context of the current user, gaining high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Microsoft Excel (Office 2016 through LTSC 2024, Microsoft 365 Apps, and Mac editions) allows an attacker to run arbitrary code by tricking a user into opening a maliciously crafted spreadsheet that triggers a type-confusion condition in Excel's file parser. The CVSS 3.1 score is 7.8 (High) with the local vector reflecting file-open exploitation rather than remote-network access, and success requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Microsoft Office Excel (across Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and their macOS equivalents) arises from a use-after-free (CWE-416) memory-corruption flaw triggered when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can achieve full confidentiality, integrity, and availability impact but requires the victim to open a file, making it a classic phishing-delivered client-side bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Excel memory-corruption bugs are historically attractive targets.
Local arbitrary code execution in Microsoft Excel arises from a heap-based buffer overflow (CWE-122) triggered when a user opens a maliciously crafted spreadsheet; successful exploitation runs attacker code in the context of the current user across desktop Office builds (Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps) on both Windows and Mac, as well as Office Online Server. The flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact but requires user interaction (opening the file). No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available from Microsoft.
Local code execution in Microsoft Excel (2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption (CWE-416) that an attacker triggers when a victim opens a maliciously crafted spreadsheet. Exploitation runs code in the context of the current user and requires user interaction (opening the file), with no public exploit identified at time of analysis. This is a locally-exploited, phishing-delivered class of bug typical of Office file-format handlers, patched by Microsoft via MSRC.
Local code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from a stack-based buffer overflow (CWE-121) triggered when a user opens a maliciously crafted spreadsheet. An attacker who convinces a victim to open the file runs arbitrary code in the security context of the current user, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; Microsoft has released a patch.
Local code execution in Microsoft Excel (including Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted spreadsheet, letting an attacker run arbitrary code in the user's context. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that exploitation needs user interaction but no prior privileges once the file is opened. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch.
Local code execution in Microsoft Office Excel results from an integer underflow (CWE-122 heap-based) that allows an unauthorized attacker to run arbitrary code in the context of the user opening a crafted spreadsheet. The CVSS 7.8 score reflects local attack vector with required user interaction, and no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the originating CNA, and the issue is tagged as a buffer/heap overflow class flaw.
Local code execution in Microsoft Office Excel stems from an integer underflow that, when triggered by opening a crafted spreadsheet, allows an attacker to run arbitrary code in the context of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation requires the victim to open a malicious file, and there is no public exploit identified at time of analysis. With a base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation effectively gives the attacker the victim's privileges on the host.
Information disclosure in Microsoft Office Excel allows remote unauthenticated attackers to read out-of-bounds memory over a network, potentially exposing sensitive data from process memory. The CVSS 8.2 score reflects high confidentiality impact with no authentication or user interaction required per the CVSS vector. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Local code execution in Microsoft Office Excel stems from an integer underflow condition that can be triggered when a victim opens a malicious spreadsheet, leading to out-of-bounds memory access (CWE-125). The flaw requires user interaction but no prior authentication on the target, and no public exploit identified at time of analysis. With a CVSS of 7.8 (high) and the typical phishing-friendly delivery model of Office files, this fits the profile of a document-based client-side RCE primitive.
Local code execution in Microsoft Office Excel can be achieved by an unauthenticated attacker who tricks a user into opening a malicious spreadsheet that triggers an integer underflow condition. The flaw carries a CVSS 7.0 rating reflecting high attack complexity and required user interaction, and no public exploit identified at time of analysis. There is a notable mismatch between the description (integer underflow) and the assigned CWE-362 (race condition), which warrants verification with Microsoft's advisory.
Local code execution in Microsoft Office Excel arises from an integer underflow condition that corrupts memory when a malicious spreadsheet is opened. The flaw requires user interaction (UI:R) to trigger but needs no prior authentication, enabling attackers to run arbitrary code in the security context of the victim user. At the time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019, LTSC 2021/2024, Office for Mac, and Office Online Server) is possible when a user opens a maliciously crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122), running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%, 18th percentile), but the technical impact is total (full confidentiality, integrity, and availability loss). Microsoft has released patches; exploitation requires the victim to open a file, so it is a phishing/social-engineering-driven local vulnerability rather than a remotely wormable one.
Local code execution in Microsoft Office Excel (Excel 2016, Office 2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a specially crafted spreadsheet. Successful exploitation yields full compromise of the current user's context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none, indicating this is a patch-in-cycle issue rather than an active threat.
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Microsoft Excel use-after-free vulnerability (CWE-416) enables arbitrary code execution when a user opens a specially crafted Excel file. Affects Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. CVSS 7.8 (High) requires local access and user interaction but no authentication. No public exploit identified at time of analysis. Microsoft released patches addressing all affected product lines per MSRC update guide.
Use-after-free vulnerability in Microsoft Office Excel enables local code execution when users open maliciously crafted Excel files. Affects all major Office versions including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. Attack requires no authentication (PR:N) but demands user interaction (opening a weaponized document). CVSS 7.8 (High) reflects significant impact potential (code execution with high confidentiali
Use-after-free memory corruption in Microsoft Excel across Office 2016-2024 and Microsoft 365 enables local code execution when a user opens a malicious spreadsheet. Attackers must craft a weaponized Excel file and trick users into opening it, after which arbitrary code runs with the victim's privileges. No authentication is required, though user interaction is necessary. Exploitation probability remains moderate (CVSS 7.8) with no confirmed active exploitation (no CISA KEV listing) and no publi
Microsoft Excel memory corruption via use-after-free enables arbitrary code execution when victims open malicious spreadsheet files. This vulnerability affects all major Office deployments including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, and Office LTSC 2021/2024 for both Windows and macOS, as well as Office Online Server. Attackers require user interaction to open a crafted file, but no authentication is needed (CVSS PR:N), making this exploitable through phishing or file-sharing attacks. Vendor patches are available through Microsoft Security Response Center. No public exploit or active exploitation confirmed at time of analysis, though the straightforward attack vector (local file + user click) and high impact (code execution with full system privileges) warrant prompt patching.
Out-of-bounds read vulnerability (CWE-125) in Microsoft Excel allows local attackers to disclose sensitive memory contents and cause denial of service through maliciously crafted spreadsheet files with user interaction. Affects Microsoft Office 2016/2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server across Windows and macOS platforms. CVSS 7.1 reflects high confidentiality and availability impact with low attack complexity but requires local access and user interaction. No public exploit identified at time of analysis. Vendor-released patches available through Microsoft Security Response Center covering all affected Office product lines.
Microsoft Excel and Office products are vulnerable to local code execution through unsafe pointer dereferencing, requiring user interaction to trigger. An attacker with local access can exploit this flaw to achieve arbitrary code execution with full system privileges. No patch is currently available, leaving users of affected Office versions at risk.
Arbitrary code execution in Microsoft Office Excel and related products (Office Online Server, 365 Apps) via out-of-bounds memory read allows local attackers to achieve complete system compromise without requiring user interaction or elevated privileges. This high-severity vulnerability affects multiple Microsoft Office components and currently lacks a security patch. An attacker with local access can exploit memory corruption to execute malicious code with full system permissions.
Heap buffer overflow in Microsoft Office Excel enables local code execution with high integrity and confidentiality impact affecting Office, Office Online Server, and 365 Apps. An attacker with user interaction can achieve arbitrary code execution in the context of the affected application. No patch is currently available for this vulnerability.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]
Privilege escalation in Microsoft Office Excel (including 365 Apps and Long Term Servicing Channel) via heap-based buffer overflow allows local attackers with user interaction to gain elevated system privileges. The vulnerability affects multiple Office product lines and currently lacks a security patch. With a CVSS score of 7.8, this poses a significant risk to organizations using affected Excel versions.
Arbitrary code execution in Microsoft Office Excel results from an integer underflow vulnerability in the Long Term Servicing Channel and Online Server editions, exploitable by local attackers with user interaction. This HIGH severity flaw (CVSS 7.8) grants full system compromise capabilities including code execution, data theft, and service disruption with no available patch.
Arbitrary code execution in Microsoft Excel through unsafe pointer handling enables local attackers to achieve full system compromise without requiring elevated privileges. This vulnerability affects Microsoft 365 Apps, Office, Office Online Server, and Office Long Term Servicing Channel across multiple versions. No patch is currently available, leaving affected systems vulnerable to exploitation via maliciously crafted spreadsheets.