Executive brief
Microsoft Excel is a widely used spreadsheet application for data analysis and financial reporting. A security vulnerability has been identified that could allow an attacker to take control of a user's computer if the user opens a specially crafted, malicious Excel file. This could lead to the theft of sensitive data, unauthorized access to corporate networks, or the installation of malware.
Technical details
An integer underflow (wraparound) vulnerability exists in Microsoft Office Excel, which can lead to a use-after-free condition (CWE-416) or numeric truncation error (CWE-197). The vulnerability is triggered when the application processes a malformed Excel file. An attacker can exploit this by convincing a user to open a malicious file, leading to arbitrary code execution in the context of the current user. The attack vector is local, requiring user interaction (UI:R), but requires no prior administrative privileges (PR:N). Microsoft has released security updates to address this issue via the MSRC update guide.
Affected products
- Microsoft Excel
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory