CVE-2026-81947

CVE-2026-81947 is a heap-based buffer overflow (CWE-122) in Microsoft Excel, the spreadsheet component of Microsoft Office. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates exploitation occurs locally, requires no privileges, and depends on user interaction — consistent with a scenario in which a user is induced to open malicious Excel content. If exploited, an unauthorized attacker gains the ability to execute code on the victim's machine with that user's privileges, enabling data theft, malware installation, or a foothold for further compromise. Any user or deployment running Excel within Microsoft 365 Apps, Microsoft 365, Office 2016, 2019, 2021, or 2024, or Office Online Server is potentially affected. There is currently no known in-the-wild exploitation, no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.3% chance of exploitation within the next 30 days.

What to do: Apply Microsoft's current security update for Excel/Office covering Microsoft 365 Apps, Office 2016/2019/2021/2024, and Office Online Server, prioritizing endpoints where users open files from external sources. Until patched, caution users about unsolicited or unexpected Excel files and rely on Protected View / Mark-of-the-Web handling, since exploitation requires user interaction. Administrators running Office Online Server should include those servers in the same update cycle and verify patch levels afterward.