CVE-2026-81398

Microsoft Excel contains a heap-based buffer overflow (CWE-122) that can be triggered by parsing maliciously crafted spreadsheet content. Per the CVSS vector (AV:L/AC:L/PR:N/UI:R), exploitation requires an unauthenticated attacker to lure a user into opening a hostile Excel file locally, with user interaction as the trigger. Successful exploitation yields arbitrary code execution in the context of the signed-in user, with high impact on confidentiality, integrity, and availability. The affected product set spans Excel within Microsoft 365/Microsoft 365 Apps and the perpetual Office 2016, 2019, 2021, and 2024 releases. Exploitation status is currently quiet: no in-the-wild reports, no known public PoC, not in CISA KEV, and EPSS assigns only a 0.3% probability of exploitation within 30 days.

What to do: Apply Microsoft's security update for CVE-2026-81398 from Microsoft's advisory to every affected Office channel in the environment, including Microsoft 365 Apps and supported perpetual Office releases, and verify the patched Excel build number against the advisory. Until patching completes, discourage opening spreadsheets from untrusted sources and rely on Protected View, email attachment filtering, and Office attack-surface-reduction rules to limit exposure. Note that the low EPSS and absence of a public PoC suggest limited near-term risk, but parser heap overflows in Office are a recurring exploitation target, so prioritize patching during the next maintenance cycle.