CVE-2026-81959 – Microsoft Excel Remote Code Execution Vulnerability

CVE-2026-81959 is a Critical remote code execution vulnerability affecting Microsoft Excel and multiple Microsoft Office releases. A heap-based buffer overflow involving integer overflow or wraparound can allow an unauthorized attacker to execute code locally. Exploitation requires a user to open a malicious Office file, but the attacker does not require prior privileges. The Preview Pane is not an attack vector.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: An attacker can send a specially crafted Office file and convince a user to open it. Successful exploitation can execute code and has the potential for high impact to confidentiality, integrity, and availability. Attack complexity is rated Low, and no attacker privileges are required.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY: CVE-2026-81959 involves a heap-based buffer overflow and integer overflow or wraparound in Microsoft Office Excel. Processing a malicious Office file can trigger the vulnerability and allow an unauthorized attacker to execute code locally. The attack has Low complexity and requires no existing privileges, although user interaction is required because the victim must open the malicious file. Successful exploitation can have High confidentiality, integrity, and availability impact. The Preview Pane does not trigger the vulnerability.

EXPLOITABILITY: Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. Exploitation requires an attacker to convince a user to open a malicious Office file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run through a malicious Office document, potentially exposing sensitive information, modifying data, or disrupting affected systems. Organizations where users routinely receive Office documents may face increased exposure to file-based social-engineering attacks.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available. If patching cannot occur immediately, no source-confirmed workaround can be recommended.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impact. Although exploitation is currently assessed as Less Likely and no active exploitation is identified, affected Microsoft 365, Excel, and Office installations should receive the official fix as a priority.