Description

Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:19:04.353Z",
  "pubdate": "2026-08-11T17:19:04.353Z",
  "executiveSummary": "A numeric truncation error exists within Microsoft Office Excel, enabling an unauthorized local attacker to execute arbitrary code within the context of the current user session.\nThe vulnerability resides in how Microsoft Office Excel parses specific numeric data structures, where improper integer conversion or bounds calculation leads to a memory corruption condition.\nSuccessful exploitation of this flaw can result in full code execution, allowing the adversary to compromise data integrity, confidentiality, and availability on the target system.\nThe risk implication is critical, as malicious actors can package the exploit within a specially crafted spreadsheet file and deliver it to victims via social engineering vectors, such as email attachments or shared network resources.\nExploitation requires the target user to open the malicious file using a vulnerable installation of Microsoft Office Excel.\nNo specific privileges are required by the attacker to craft the payload, but successful execution is constrained by the access rights of the victim opening the document.",
  "technicalDetails": "The root cause of the vulnerability is a numeric truncation error within the data parsing engine of Microsoft Office Excel.\nWhen processing malformed or maliciously constructed numeric records inside a spreadsheet, the application performs an unsafe integer conversion or arithmetic operation that truncates larger values into smaller data types.\nThis truncation miscalculates the required buffer size or memory allocation offset, resulting in a heap-based or stack-based buffer overflow when subsequent data is read into the insufficiently allocated memory structure.\nThe affected component is the core parsing module responsible for handling specific record types within Microsoft Office Excel files.\nThe attack flow initiates when an unauthorized attacker constructs a malicious file containing manipulated numeric attributes designed to trigger the truncation flaw.\nThe attacker delivers this file to the victim system locally or via standard distribution channels.\nUpon interaction, the victim opens the file using Microsoft Office Excel.\nThe vulnerable parser processes the malformed numeric structures, triggering the numeric truncation error and subsequent memory corruption.\nAn attacker can leverage this memory corruption to overwrite critical execution pointers, such as return addresses or function pointers, redirecting control flow to attacker-supplied shellcode or leveraging return-oriented programming (ROP) chains.\nPost-exploitation impact includes the execution of arbitrary payloads with the privileges of the logged-in user, potentially enabling installation of malware, escalation of privileges, or lateral movement within the network.\nAuthentication requirements are none for the initial file delivery, and network exposure is local to the victim workstation executing the file."
}