Executive brief
Microsoft Excel is a spreadsheet application used across organizations for data analysis and reporting. A heap-based buffer overflow vulnerability in Excel could allow an attacker to execute arbitrary code locally on systems where Excel is installed, potentially compromising sensitive financial data, business records, and system security.
Technical details
A heap-based buffer overflow exists in Microsoft Office Excel, triggered when processing specially crafted spreadsheet files. The vulnerability allows a local attacker to achieve arbitrary code execution with the privileges of the Excel process. The attack requires a user to open a malicious file, but does not require authentication to the system. Exploitation results in code execution that could lead to data theft, malware installation, or system compromise. Microsoft has released patches to address this vulnerability.
Affected products
- Microsoft Office Excel
Timeline
- 2026-09-08: disclosed