CVE-2026-81949 – Microsoft Excel Remote Code Execution Vulnerability

CVE-2026-81949 is a critical remote code execution vulnerability caused by an integer overflow or wraparound in Microsoft Office Excel. An unauthorized attacker can send a specially crafted Office file and convince a user to open it, potentially resulting in code execution. Exploitation requires no privileges but does require user interaction. The Preview Pane is not an attack vector.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: An attacker could use a malicious Office file to trigger the vulnerability when a targeted user opens it. Successful exploitation can have a high impact on confidentiality, integrity, and availability. Attack complexity is rated Low, and the attacker requires no privileges.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and the exploitation assessment is Exploitation Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is caused by an integer overflow or wraparound (CWE-190) in Microsoft Office Excel. A malicious Office file can trigger the vulnerable behavior after a user is convinced to open it, allowing an unauthorized attacker to execute code locally. The attack has low complexity and requires no existing privileges, although user interaction is required. Successful exploitation can result in high confidentiality, integrity, and availability impact. The Preview Pane cannot be used to trigger this vulnerability.

EXPLOITABILITY: Affected software includes 32-bit and 64-bit versions of Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exploitation requires an attacker to deliver a malicious Office file and convince the user to open it.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to execute and cause significant compromise of affected endpoints. With high confidentiality, integrity, and availability impacts, organizations could face exposure or modification of information and disruption of affected systems.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability carries a Critical severity rating and can lead to remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft 365, Excel, and Office installations.