CVE-1999-1055
HighExploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, known as the Excel 'CALL Vulnerability.'
Risk Assessment
This vulnerability could lead to unauthorized code execution, posing a serious threat to the security of organizational data and systems.
Recommendation
It is recommended to upgrade to a newer version of Microsoft Excel that is not vulnerable to this flaw and to implement appropriate security measures to restrict the execution of unknown DLLs.
Other vulnerabilities in Microsoft Excel 97
See all- CVE-2024-26257High
A vulnerability in Microsoft Excel allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw to execute malicious code on the compromised device.
- CVE-2023-23398High
A vulnerability in Microsoft Excel allows for spoofing, which may lead to unauthorized access to user data. An attacker can exploit this flaw to mislead the user into opening a malicious file.
- CVE-2022-29109High
A vulnerability in Microsoft Excel allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw to run malicious software on the infected device.
- CVE-2022-26901High
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
- CVE-2022-24473High
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
- CVE-2022-21841High
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
- CVE-2021-43256High
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
- CVE-2023-33133High
A vulnerability in Microsoft Excel allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw through malicious Excel files.
- CVE-2021-42292HighActively exploited
Microsoft Excel Security Feature Bypass Vulnerability. Details are not provided in the description, but it allows an attacker to bypass security features.
- CVE-2021-38655High
Vulnerability in Microsoft Excel allows remote code execution. An attacker could exploit it to run arbitrary code on the victim's system.
Original NVD description (English source)
Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, aka the Excel "CALL Vulnerability."