CVE-2026-81396

CVE-2026-81396 is a stack-based buffer overflow (CWE-121, tagged alongside CWE-193 off-by-one) in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates exploitation requires local access, no privileges, and user interaction, consistent with the typical Office scenario of a victim opening a maliciously crafted spreadsheet. Successful exploitation would let an attacker run arbitrary code in the context of the logged-in user, with high impact on confidentiality, integrity, and availability (scope unchanged). Anyone running Microsoft Excel — including Microsoft 365 Apps/Microsoft 365 and Office 2016, 2019, 2021, and 2024 — is potentially affected. As of now there is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.4% chance of exploitation within 30 days, so no active exploitation is known.

What to do: Install Microsoft's current security updates for Excel and the affected Office releases as soon as available, prioritizing endpoints where users open untrusted spreadsheets, and check Microsoft's advisory for the exact fixed builds. Until patched, discourage opening spreadsheets from untrusted sources and rely on Protected View / Mark-of-the-Web restrictions to reduce risk. Because EPSS is low and no PoC or in-the-wild exploitation is known, applying the patch on your normal cycle is reasonable except for high-risk users.