CVE-2026-81960

CVE-2026-81960 is a heap-based buffer overflow (CWE-122) in the spreadsheet component of Microsoft Excel that can corrupt memory when the application processes crafted content. The CVSS vector (AV:L/PR:N/UI:R) indicates exploitation requires user interaction in a local context, most plausibly a user opening a malicious spreadsheet, with no special privileges needed beforehand. A successful attack lets an unauthorized attacker execute arbitrary code locally with the privileges of the logged-in user, with high impact on confidentiality, integrity, and availability of the endpoint. Per Microsoft's CPE data, affected deployments include Microsoft 365 and Microsoft 365 Apps as well as perpetual Office 2016, 2019, 2021, and 2024. There is currently no public proof-of-concept, no CISA KEV listing, and a low 0.4% EPSS score, indicating no known exploitation in the wild.

What to do: Apply the Microsoft security update for Excel covering Microsoft 365 Apps and Office 2016/2019/2021/2024 as soon as it is published, prioritizing shared and privileged workstations, and verify installed Office build numbers against Microsoft's advisory since this data does not include exact version ranges. Because exploitation requires user interaction (opening crafted content), caution users about unsolicited spreadsheets and keep Office Protected View and macro/security warnings enabled.