CVE-2026-88145
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122, CWE-190
Impact
Remote attackers can execute arbitrary code with the privileges of the local user if they trick someone into opening a crafted Excel document. The attack requires user interaction to open the malicious file.
Root cause
An integer overflow leads to a heap-based buffer overflow when parsing Excel files.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the security update provided by Microsoft in the vendor advisory. As an interim workaround, block untrusted Excel attachments at the email gateway and open suspicious workbooks in Protected View.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.