CVE-2026-81953 – Microsoft Excel Remote Code Execution Vulnerability

CVE-2026-81953 is a Critical remote code execution vulnerability in Microsoft Excel caused by a stack-based buffer overflow. An attacker can send a specially crafted Office file and convince a user to open it, potentially allowing unauthorized code execution. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: An attacker could use a malicious Office file to trigger a stack-based buffer overflow and execute code locally. The attack has low complexity and requires no attacker privileges, but user interaction is required because the targeted user must open the malicious file. The Preview Pane is not an attack vector.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is a stack-based buffer overflow, classified as CWE-121, affecting Microsoft Office Excel. A malicious Office file can trigger improper memory handling when opened. The attack vector is local, attack complexity is low, privileges are not required, and user interaction is required. Successful exploitation can execute unauthorized code and has High confidentiality, integrity, and availability impact. Scope remains unchanged.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit, Microsoft Excel 2016 32-bit and 64-bit, Microsoft Office 2019 32-bit and 64-bit, Microsoft Office LTSC 2021 32-bit and 64-bit, and Microsoft Office LTSC 2024 32-bit and 64-bit. Exploitation requires convincing a user to open a malicious Office file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on an affected system, potentially compromising sensitive information, changing data, or disrupting system availability. A malicious document reaching an employee could therefore become an entry point for a serious endpoint compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impact. Although exploitation is assessed as Less Likely and no active exploitation is identified, organizations should prioritize the official fix because exploitation requires no attacker privileges and has low attack complexity.