CVE-2026-105718 – Microsoft Excel Remote Code Execution Vulnerability

Microsoft has identified a critical remote code execution (RCE) vulnerability in Microsoft Excel that could allow an unauthorized attacker to execute malicious code on an affected system. The vulnerability is caused by an out-of-bounds read and improper input validation. An attacker could exploit this weakness by creating a malicious Office document and convincing a user to open it. Successful exploitation could compromise sensitive business information, allow unauthorized modifications, or disrupt system availability. Although exploitation is considered less likely and no active exploitation has been reported, the vulnerability presents a significant security risk because it requires no prior attacker privileges and has low attack complexity.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant threat to organizations that rely on Microsoft Excel and Office applications for daily business operations.

Attackers could distribute specially crafted Excel files through phishing emails or other file-sharing methods, attempting to trick employees into opening malicious documents.

The vulnerability requires user interaction, but attackers do not need existing privileges on the targeted system.

Successful exploitation could result in:

• Remote Code Execution: Attackers could execute malicious code on affected systems.
• Sensitive Data Exposure: Confidential business information and other sensitive data could be compromised.
• System Compromise: Attackers could potentially install malicious software or manipulate information.
• Business Disruption: Compromised systems could experience operational interruptions or loss of availability.

The combination of low attack complexity, no required attacker privileges, and high potential impact makes this vulnerability a serious concern.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication:

• Actively Exploited: No.
• Publicly Disclosed: No.
• Public Exploit Code: Exploit code maturity is classified as unproven. The existence of publicly available exploit code is not confirmed.
• Zero-Day Exploitation: No active exploitation has been reported, and zero-day exploitation is not confirmed.
• Proof-of-Concept (PoC): The existence of publicly available PoC exploit code is not confirmed.

Although there is no confirmed active exploitation, attackers could potentially develop malicious Office documents to exploit this vulnerability.

Technical Summary

CVE-2026-105718 is a remote code execution vulnerability affecting Microsoft Excel within several Microsoft Office products.

The vulnerability is associated with two security weaknesses:

CWE-125 – Out-of-bounds Read: This weakness occurs when an application reads memory outside the intended boundaries of a data structure.

CWE-20 – Improper Input Validation: This weakness occurs when an application fails to properly validate input before processing it.

These weaknesses could allow an attacker to exploit the way Microsoft Excel processes specially crafted Office files.

To exploit the vulnerability, an attacker must create a malicious Office document and convince a targeted user to open it.

When the malicious document is opened, the vulnerability could be triggered, potentially allowing the attacker to execute unauthorized code.

The vulnerability has the following technical characteristics:

• Attack Vector: Network.
• Attack Complexity: Low.
• Privileges Required: None.
• User Interaction: Required.
• Scope: Unchanged.
• Confidentiality Impact: High.
• Integrity Impact: High.
• Availability Impact: High.

Importantly, the Microsoft Office Preview Pane is not an attack vector for this vulnerability.

The vulnerability carries a CVSS 3.1 base score of 8.8 and a temporal score of 7.7.

Microsoft has identified an official fix, making patch deployment the primary remediation approach.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit).
• Microsoft Office 365 for Mac.
• Microsoft Office LTSC 2021 (32-bit and 64-bit).
• Microsoft Office LTSC 2024 (32-bit and 64-bit).
• Microsoft Office LTSC for Mac 2021.
• Microsoft Office LTSC for Mac 2024.
• Office Online Server.

The specific affected build numbers are not identified.

How exploitation works:

An attacker creates a malicious Office document and convinces a user to open it.

Opening the document could trigger the vulnerability and allow remote code execution.

No prior attacker privileges are required, but user interaction is necessary.

Business Impact

This vulnerability could have serious consequences for organizations that depend on Microsoft Office applications to manage financial records, customer information, operational documents, and other sensitive business data.

A single malicious document could turn a routine business activity into a major security incident.

If successfully exploited, the vulnerability could lead to several business risks.

1. Sensitive Information Exposure

Attackers could potentially access confidential business documents, financial information, or other sensitive organizational data.

2. Unauthorized System Access

Successful remote code execution could allow attackers to run malicious commands or software on compromised systems.

3. Operational Disruption

Compromised systems could experience interruptions, affecting employee productivity and critical business activities.

4. Data Integrity Risks

Attackers could potentially modify or damage important business information, reducing its reliability and availability.

5. Financial and Reputational Damage

A successful attack could result in incident response expenses, recovery costs, operational downtime, and reputational damage.

Organizations with large Microsoft Office deployments may face broader exposure because the vulnerability affects multiple Windows and Mac Office products.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

If immediate patch deployment is not possible, organizations should consider temporary risk-reduction measures:

• Avoid opening unexpected or suspicious Office documents.
• Educate employees about malicious Office attachments and phishing attempts.
• Restrict access to untrusted Office files where operationally feasible.
• Monitor endpoints for suspicious activity associated with Office applications.
• Prioritize affected systems for security updates.

These precautions may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

High Priority – Critical Security Update

CVE-2026-105718 should be prioritized for deployment because it is classified as Critical and could allow remote code execution.

Although Microsoft currently considers exploitation less likely and no active exploitation has been reported, the vulnerability has several concerning characteristics.

Attackers require no existing privileges, attack complexity is low, and successful exploitation could severely affect confidentiality, integrity, and availability.

The vulnerability also affects multiple Microsoft Office products commonly deployed across enterprise environments.

The absence of known attacks does not eliminate the risk. Delaying security updates leaves systems exposed to potential exploitation through malicious Office documents.

Organizations should prioritize patch deployment across affected Microsoft 365, Office LTSC, and Office Online Server environments.

Special attention should be given to systems frequently used to open external Office documents.

Recommended Deployment Priority: HIGH – Deploy promptly through the organization’s critical patch management process.