Executive brief
Microsoft Excel contains a heap-based buffer overflow vulnerability that allows attackers to execute arbitrary code on a user's computer when a maliciously crafted spreadsheet file is opened. This could lead to complete system compromise, including unauthorized access to sensitive data, installation of malware, or use of the compromised computer to attack other systems.
Technical details
A heap-based buffer overflow exists in Microsoft Excel's file parsing logic. The vulnerability is triggered when Excel processes a specially crafted spreadsheet file, causing a buffer overrun in the heap memory region. An attacker can exploit this by sending or hosting a malicious Excel file that, when opened by a user, executes arbitrary code with the privileges of the user running Excel. No special privileges or prior authentication are required; user interaction (opening the file) is the only precondition. The attack vector is local execution via file handling.
Affected products
- Microsoft Excel
Timeline
- 2026-09-08: disclosed