CVE-2026-20956CWE-822

Microsoft Excel Remote Code Execution Vulnerability

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

⚡ An untrusted pointer dereference could turn your Excel files into a hacker's playground! 🚨 Think of this as a restaurant where the chef is instructed to use any random ingredient without checking if it’s safe — if the wrong item is used, it could lead to a disastrous meal. In this case, an attacker can slip in malicious code that Excel unwittingly prepares and serves! An unauthorized attacker could execute arbitrary code locally, potentially leading to compromised data, unauthorized access, or even full control of the user's device. It's like handing someone a master key to your office — they could access, modify, or delete anything they want!

Put simply

Think of this as a restaurant where the chef is instructed to use any random ingredient without checking if it’s safe — if the wrong item is used, it could lead to a disastrous meal. In this case, an attacker can slip in malicious code that Excel unwittingly prepares and serves! This vulnerability allows attackers to exploit an untrusted pointer dereference within Microsoft Office Excel, leading to execution of malicious code without proper authorization. The flaw resides in how Excel handles pointers, allowing for errant memory access that can be manipulated.

What to do

An unauthorized attacker could execute arbitrary code locally, potentially leading to compromised data, unauthorized access, or even full control of the user's device. It's like handing someone a master key to your office — they could access, modify, or delete anything they want! To mitigate this vulnerability, immediately update Microsoft Office Excel to the latest version. Ensure your systems have the latest patches applied to prevent exploitation. Regularly review user permissions and consider disabling macros for untrusted files if not needed. You've got this! With a quick update and some smart precautions, you'll keep your Excel files safe and secure! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00449 · 38.0th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2026-01-13T17:56Z
EPSS history
Timeline
  • 13 JAN 17:56Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5