CVE-2026-20950CWE-416

Microsoft Excel Remote Code Execution Vulnerability

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

⚡ A sneaky use-after-free flaw in Microsoft Excel opens the door for unauthorized code execution, all while you’re just trying to crunch numbers! 📊 Think of this vulnerability as a lost receipt in a restaurant. If the waiter doesn't check the system after you've left, someone could use that receipt to order a bunch of expensive meals on your tab! This vulnerability could allow an attacker to run unauthorized code on your system — imagine them taking control of your Excel environment, which could lead to data theft, malicious software installation, or worse! It’s a high-risk situation that every Excel user should take seriously.

Put simply

Think of this vulnerability as a lost receipt in a restaurant. If the waiter doesn't check the system after you've left, someone could use that receipt to order a bunch of expensive meals on your tab! The use-after-free error in Microsoft Excel occurs when memory that is no longer needed is still accessed, allowing attackers to execute arbitrary code locally. This flaw could be exploited without any prior authentication, making it particularly dangerous for users.

What to do

This vulnerability could allow an attacker to run unauthorized code on your system — imagine them taking control of your Excel environment, which could lead to data theft, malicious software installation, or worse! It’s a high-risk situation that every Excel user should take seriously. To protect yourself, update to the latest version of Microsoft Excel as soon as possible. Microsoft has likely issued a patch to address this issue, so don’t delay! Regularly review your software for updates to ensure you’re not leaving any door open for attackers. You've got this! With a quick update, you can lock down your Excel environment and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.1th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-13T17:57Z
EPSS history
Timeline
  • 13 JAN 17:57Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5