CVE-2026-21259CWE-122

Microsoft Excel Elevation of Privilege Vulnerability

High · published February 10, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

⚡ A heap-based buffer overflow in Microsoft Office Excel could let an unauthorized attacker elevate their privileges locally — that's like giving someone the keys to your office without you even knowing! Think of it like a sneaky construction worker who finds a way to access the blueprints of your building, allowing them to make unauthorized changes without your approval. With the right malicious input, an attacker can manipulate Excel's memory, affecting the whole application. This vulnerability could allow an attacker to execute arbitrary code with higher privileges, potentially leading to compromised sensitive information or unauthorized actions within Excel. If exploited, it could give attackers the ability to manipulate data, install malware, or damage your files — a real digital nightmare!

Put simply

Think of it like a sneaky construction worker who finds a way to access the blueprints of your building, allowing them to make unauthorized changes without your approval. With the right malicious input, an attacker can manipulate Excel's memory, affecting the whole application. The vulnerability occurs due to improper handling of memory in Excel, specifically allowing for a heap-based buffer overflow which can be exploited without prior authentication.

What to do

This vulnerability could allow an attacker to execute arbitrary code with higher privileges, potentially leading to compromised sensitive information or unauthorized actions within Excel. If exploited, it could give attackers the ability to manipulate data, install malware, or damage your files — a real digital nightmare! To mitigate this risk, Microsoft recommends updating Excel to the latest version immediately. Additionally, ensure that all users are trained to avoid opening unknown or untrusted files that could trigger this exploit. Regularly check for updates as new patches are released! You've got this! Stay vigilant, patch up, and you'll keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00559 · 45.8th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Microsoft Excel Elevation of Privilege Vulnerability
    cvelistv5