CVE-1999-1055
HighExploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, known as the Excel 'CALL Vulnerability.'
Risk Assessment
This vulnerability could lead to unauthorized code execution, posing a serious threat to the security of organizational data and systems.
Recommendation
It is recommended to upgrade to a newer version of Microsoft Excel that is not vulnerable to this flaw and to implement appropriate security measures to restrict the execution of unknown DLLs.
Original NVD description (English source)
Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, aka the Excel "CALL Vulnerability."