CVE-2026-81388

Microsoft Excel is affected by a stack-based buffer overflow (CWE-121) that an unauthorized local attacker can leverage to execute arbitrary code. The CVSS vector indicates the attack requires user interaction and no privileges or special conditions, consistent with an attacker convincing a user to open a specially crafted Excel workbook on a vulnerable machine. Successful exploitation would yield code execution in the context of the local user, with high impact on confidentiality, integrity, and availability of the affected system. Affected products include Excel within Microsoft 365/Microsoft 365 Apps and the perpetual Office 2016, 2019, 2021, and 2024 releases. As of this analysis there is no known exploitation, no public proof-of-concept, and the flaw is not listed in CISA's KEV; EPSS estimates roughly a 0.5% chance of exploitation within 30 days.

What to do: Apply the Microsoft security update for CVE-2026-81388 across all affected Office channels (Microsoft 365 Apps and Office 2016/2019/2021/2024), using the fixed builds listed in Microsoft's advisory since specific version numbers are not provided here. Until patched, treat unsolicited Excel workbooks and spreadsheets from untrusted sources as suspect, since exploitation requires user interaction. There is no evidence of active exploitation, so patching on your normal monthly cycle is defensible for most environments, with faster action for high-risk users or shared workstations handling untrusted files.