CVE-2026-20946CWE-125

Microsoft Excel Remote Code Execution Vulnerability

High Β· published January 13, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

🚨 An out-of-bounds read in Microsoft Excel lets unauthorized attackers execute code on your system! πŸ”₯ Think of this like a rogue delivery driver who sneaks a peek inside your mailroom, rifling through sensitive documents without permission β€” all because a security measure was overlooked. πŸ“¬ If exploited, this vulnerability could lead to local code execution, allowing attackers to manipulate your files, install malware, or even wipe out your data! It's a serious invasion of your digital workspace, potentially wreaking havoc on your projects and sensitive information.

Put simply

Think of this like a rogue delivery driver who sneaks a peek inside your mailroom, rifling through sensitive documents without permission β€” all because a security measure was overlooked. πŸ“¬ This vulnerability arises from an out-of-bounds read, permitting unauthorized access to memory, which could be leveraged to execute arbitrary code locally in Excel.

What to do

If exploited, this vulnerability could lead to local code execution, allowing attackers to manipulate your files, install malware, or even wipe out your data! It's a serious invasion of your digital workspace, potentially wreaking havoc on your projects and sensitive information. To mitigate this threat, ensure your Microsoft Office Excel is updated to the latest version. Apply the security patches provided by Microsoft immediately and educate users about the dangers of opening untrusted Excel files. πŸ›‘οΈ You've got this! With these steps, you can secure your environment and keep those pesky attackers at bay! πŸ’ͺπŸ¦Έβ€β™‚οΈ

The record
Technical detail
CVSS v3.1
7.8 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00654 Β· 50.7th percentile
Weakness
CWE-125 Β· Out-of-bounds Read
Published
2026-01-13T17:56Z
EPSS history
Timeline
  • 13 JAN 17:56Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5