CVE-2026-108446
8.8HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416
Impact
Remote attackers can execute arbitrary code on the victim's system in the context of the current user. To exploit it, they need a target user to open a malicious Excel file.
Root cause
A use-after-free condition in Microsoft Office Excel mishandles memory during file processing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Install the latest Microsoft Office/Excel security update from MSRC for your release channel. If patching immediately is not possible, block untrusted Excel attachments at the email gateway and prevent users from opening untrusted spreadsheets.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.