AI analysis
Microsoft Office Excel has an integer underflow (CWE-191) that can wrap and lead to a heap-based buffer overflow (CWE-122). A remote attacker with no prior privileges can trigger it by delivering a malicious spreadsheet over the network and getting a user to open it; user interaction is required, and the CVSS 3.1 score is 8.8 (high). Successful exploitation lets the attacker run code in the context of the user who opened the file, with high impact to confidentiality, integrity, and availability. Microsoft lists Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as affected; exact build numbers are not in the source data. The flaw is not in CISA's Known Exploited Vulnerabilities catalog, no public proof-of-concept is known, and it was covered in Microsoft's October 2026 Patch Tuesday.
What to do: Install Microsoft's October 2026 security updates for Excel across Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server through Microsoft Update or your enterprise patching process. Until those updates are applied, do not open Excel files from untrusted senders, keep Protected View enabled, and filter spreadsheet attachments at the mail gateway.
Affected
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| Microsoft Office 2021 | — |
| Microsoft Office 2024 | — |
| Microsoft Office Online Server | — |
Estimated exposure
massHundreds of millions of Microsoft 365 and Office users — Order-of-magnitude estimate from Microsoft's publicly reported Microsoft 365 subscriber base (hundreds of millions of paid seats) plus the widespread enterprise deployment of Office 2021, Office 2024, and Office Online Server; this is not…