Executive brief
A security vulnerability exists in Microsoft Excel, the widely used spreadsheet application. An attacker could exploit this flaw to run unauthorized code on a user's computer if the user is tricked into opening a specially crafted file. This could lead to a full system compromise, allowing the attacker to steal data, install malware, or disrupt business operations.
Technical details
An integer underflow (wrap or wraparound) vulnerability exists within Microsoft Office Excel. The flaw is triggered when the application improperly handles specific data structures, leading to memory corruption. To exploit this, an attacker must rely on user interaction, typically by convincing a target to open a malicious Excel file. Successful exploitation allows for local code execution with the privileges of the logged-in user. Although the Microsoft advisory mentions CWE-362 (Race Condition), the primary description identifies an integer underflow as the root cause. The attack complexity is rated as high, suggesting specific timing or environmental conditions may be required for a successful exploit.
Affected products
- Microsoft Excel
Timeline
- 2026-06-09: advisory: Initial advisory published by Microsoft and NVD.