CVE-2026-100209

CVE-2026-100209 is a use-after-free (CWE-416) in Microsoft Excel that lets an unauthorized attacker execute code with the privileges of the user who opens a crafted workbook. Delivery is over a network, but exploitation requires user interaction; complexity is low and no prior privileges are required (CVSS 3.1 base score 8.8). Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected client. Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 are listed as affected; exact build ranges are not in the source data. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 security updates for Excel in Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 as soon as they are available for your channel. Until patched, do not open Excel files from untrusted senders or sites, and prefer Protected View for internet-sourced workbooks. No public exploit or CISA KEV listing is known; still treat unpatched Excel clients as high priority because the issue is rated high severity with remote delivery and full impact if a user opens a malicious file.