CVE-2026-20955CWE-822

Microsoft Excel Remote Code Execution Vulnerability

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

⚡ An unauthorized attacker can exploit an untrusted pointer dereference in Microsoft Office Excel to run code locally — and it’s alarmingly easy! Think of it like a restaurant that serves your meal without checking the order — an attacker can slip in unwanted ingredients, potentially poisoning the dish. In this case, the ingredients are malicious commands waiting to be executed. If exploited, this vulnerability allows attackers to run arbitrary code on your system, which could lead to data breaches, corrupted files, or even total control over your machine. It's like leaving the door wide open for intruders to wreak havoc. Protect your data before they take advantage!

Put simply

Think of it like a restaurant that serves your meal without checking the order — an attacker can slip in unwanted ingredients, potentially poisoning the dish. In this case, the ingredients are malicious commands waiting to be executed. This vulnerability arises from Excel's failure to properly validate pointers, allowing an attacker to manipulate the execution flow when opening a specially crafted file. This could lead to local code execution without user consent.

What to do

If exploited, this vulnerability allows attackers to run arbitrary code on your system, which could lead to data breaches, corrupted files, or even total control over your machine. It's like leaving the door wide open for intruders to wreak havoc. Protect your data before they take advantage! To mitigate this risk, ensure that you update Microsoft Office Excel to the latest version immediately. Additionally, avoid opening untrusted Excel files, and enable all security features provided by the application to bolster protection. You've got this! By staying vigilant and following these steps, you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00615 · 48.8th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2026-01-13T17:56Z
EPSS history
Timeline
  • 13 JAN 17:56Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5