CVE-2026-81951 – Microsoft Excel Remote Code Execution Vulnerability

CVE-2026-81951 is a heap-based buffer overflow vulnerability in Microsoft Excel that can allow an unauthorized attacker to execute code locally. Exploitation requires a malicious Office file to be sent to a user and convincing that user to open it. No privileges are required, but user interaction is required. The Preview Pane is not an attack vector.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation can result in remote code execution with high impact to confidentiality, integrity, and availability. An attacker could use a specially crafted Office file as the delivery mechanism. Attack complexity is low and no privileges are required, although the targeted user must open the malicious file.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-81951 is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office Excel. An attacker can send a specially crafted Office file to a target and convince the user to open it. Processing the malicious content can trigger the memory corruption condition and allow the attacker to execute code locally. The attack has low complexity, requires no privileges, and requires user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit, Excel 2016 32-bit and 64-bit, Office 2019 32-bit and 64-bit, Office LTSC 2021 32-bit and 64-bit, and Office LTSC 2024 32-bit and 64-bit. Exploitation requires a user to open a malicious Office file.

BUSINESS IMPACT: Successful exploitation could expose sensitive information, allow unauthorized modification of data, and disrupt system availability. Because malicious documents can be used as the attack mechanism, organizations handling Office files from external or untrusted sources face a significant risk if affected installations remain unpatched.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected Microsoft Office and Excel installations should be updated.

URGENCY: This vulnerability is rated Critical and can lead to code execution with high confidentiality, integrity, and availability impact. Although exploitation is currently assessed as Less Likely and no active exploitation is reported, the combination of low attack complexity and no privilege requirement makes timely deployment important.