CVE-2026-81950

CVE-2026-81950 is a double-free memory-corruption flaw (CWE-415) in Microsoft Excel, the spreadsheet component of Microsoft Office. Based on the CVSS vector (local attack vector, no privileges, user interaction required), it is triggered by convincing a user to open a specially crafted spreadsheet or otherwise process attacker-controlled data in an affected Excel build. A successful exploit lets an unauthorized attacker execute arbitrary code in the context of the local user, with high impact to confidentiality, integrity, and availability. Users of Excel in Microsoft 365 Apps/Microsoft 365 and the perpetual Office 2016, 2019, 2021, and 2024 releases are affected. As of this analysis there is no known public proof-of-concept, no CISA KEV listing, and a low EPSS score (0.4%), indicating no confirmed exploitation; the flaw was addressed in Microsoft's September 2026 security updates.

What to do: Apply the September 2026 Microsoft security updates for Office/Excel across all affected releases (Office 2016, 2019, 2021, 2024, and Microsoft 365 Apps) and confirm the updated Excel build numbers in Microsoft's advisory. Until patching is complete, instruct users not to open spreadsheet attachments or files from untrusted sources, since exploitation requires user interaction with a malicious file. Monitor Microsoft advisories for revised build numbers and consider standard Office hardening (e.g., Protected View) as interim mitigation.