CVE-2026-100211

CVE-2026-100211 is a use-after-free flaw (CWE-416) in Microsoft Office Excel. An unauthorized attacker can reach it over a network with no prior privileges, but the user must interact with malicious content, such as opening a crafted spreadsheet. Successful exploitation can run arbitrary code on the victim's system with high impact to confidentiality, integrity, and availability. Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 are the listed affected products. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024, including Excel. Until those updates are applied, do not open Excel files from untrusted email or websites and keep Protected View enabled. No fixed build numbers were provided in the source data.