CVE-2026-68804 – Microsoft Excel Remote Code Execution Vulnerability

CVE-2026-68804 is a critical remote code execution vulnerability affecting Microsoft Excel and multiple Microsoft Office editions. The vulnerability involves numeric truncation and a heap-based buffer overflow. An attacker can send a specially crafted Office file and convince a user to open it, potentially allowing unauthorized code execution on the local machine. Exploitation requires no privileges but does require user interaction.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
Successful exploitation can allow an unauthorized attacker to execute code locally after a user opens a malicious Office file. The CVSS assessment rates the potential confidentiality, integrity, and availability impacts as High. The Preview Pane is not an attack vector.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY:
The vulnerability is associated with CWE-197 numeric truncation and CWE-122 heap-based buffer overflow conditions in Microsoft Office Excel. Exploitation involves an attacker sending a malicious Office file and persuading the target to open it. Although classified as remote code execution because the attacker may be remote, the actual attack vector is Local (AV:L), meaning exploitation occurs when the malicious content is executed from the local machine. Attack complexity is Low, privileges are not required, and user interaction is required. Successful exploitation can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected software includes 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires a user to open a malicious Office file; no privileges are required.

BUSINESS IMPACT:
Successful exploitation could enable arbitrary code execution and expose organizations to serious compromise of sensitive information, system integrity, and business availability. A convincing malicious document could make an ordinary file-opening action the trigger for a high-impact security incident.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the specified remediation path.

URGENCY:
This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impacts. Although exploitation is currently assessed as Less Likely and no active exploitation is identified, affected Microsoft Office and Excel installations should be patched urgently to remove the vulnerable condition.