CVE-2026-81950 – Microsoft Excel Remote Code Execution Vulnerability

CVE-2026-81950 is a Critical remote code execution vulnerability in Microsoft Excel and affected Microsoft Office products. The vulnerability is caused by a double-free memory condition. An attacker must convince a user to open a malicious Office file, after which code execution may occur locally without the attacker requiring privileges. The Preview Pane is not an attack vector. The vulnerability is not publicly disclosed or known to be exploited.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation can allow an unauthorized attacker to execute code on an affected system. The vulnerability has high confidentiality, integrity, and availability impacts. Attack complexity is low and no privileges are required, although user interaction is necessary.

EXPLOITS: Exploitation is assessed as less likely. Exploit code maturity is Unproven, and the vulnerability is not publicly disclosed or known to be exploited. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-81950 is a double-free vulnerability (CWE-415) affecting Microsoft Excel and related Microsoft Office products. A double-free occurs when memory is freed more than once, potentially resulting in memory corruption that can enable code execution. Exploitation requires an attacker to send a malicious Office file and persuade the user to open it. The attack vector is rated Local with Low attack complexity, no privileges required, and user interaction required. Successful exploitation can result in high impact to confidentiality, integrity, and availability. The Preview Pane cannot be used as an attack vector.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Excel 2016 (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). Exploitation requires a user to open a malicious Office file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on affected systems, creating significant confidentiality, integrity, and availability risks. For organizations, a malicious document reaching an employee could become a path to code execution and potentially compromise sensitive information or disrupt operations.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impacts. Attack complexity is low and exploitation requires no privileges, although a user must open a malicious Office file. Organizations should prioritize deployment of the official fix across affected Microsoft Excel and Office installations.