AI analysis
CVE-2026-100210 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel. An unauthorized attacker can trigger it over a network by getting a user to open a malicious Excel workbook; no privileges are required, but user interaction is. Successful exploitation can run arbitrary code in the context of the user who opened the file, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). It affects Microsoft 365, Microsoft 365 Apps, Office 2021, Office 2024, and Office Online Server. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Apply Microsoft's October 2026 security updates for Microsoft 365, Microsoft 365 Apps, Office 2021, Office 2024, and Office Online Server as soon as they are available for your channel. Until patched, treat unsolicited Excel workbooks as untrusted, open them only in Protected View or a sandboxed viewer, and block or detonate Office attachments at the mail gateway. Confirm the update is installed on endpoints and on any Office Online Server hosts.
Affected
| Microsoft 365 Apps | Affected builds as identified by Microsoft (specific build numbers not in source data) |
| Microsoft 365 | Affected builds as identified by Microsoft (specific build numbers not in source data) |
| Microsoft Office 2021 | Affected builds as identified by Microsoft (specific build numbers not in source data) |
| Microsoft Office 2024 | Affected builds as identified by Microsoft (specific build numbers not in source data) |
| Microsoft Office Online Server | Affected builds as identified by Microsoft (specific build numbers not in source data) |