Executive brief
Microsoft Office Excel contains a stack-based buffer overflow vulnerability that allows an attacker to execute arbitrary code on a user's computer. An attacker could exploit this by crafting a malicious Excel file that, when opened, triggers the vulnerability and grants the attacker the same privileges as the user running Excel.
Technical details
A stack-based buffer overflow exists in Microsoft Office Excel's file parsing logic. The vulnerability occurs when Excel processes specially crafted input that exceeds buffer boundaries, allowing an attacker to overwrite stack memory. Exploitation requires local access and user interaction (opening a malicious Excel file). A successful exploit grants code execution with the privileges of the user running Excel. Microsoft has released patches to address this issue.
Affected products
- Microsoft Office Excel
Timeline
- 2026-08-11: disclosed