CVE-2026-100209
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Risk Assessment
An unauthorized attacker can remotely execute arbitrary code, potentially taking control of the workstation of a user who opens a malicious file.
Recommendation
Install the latest Microsoft Office updates and avoid opening Excel files from untrusted sources.
Other vulnerabilities in Microsoft Office Excel
See all- CVE-2026-40360High
An out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- CVE-2026-40359High
A use after free vulnerability in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20957High
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20956High
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20955High
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20950High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20949High
Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
- CVE-2026-20946High
An out-of-bounds read vulnerability in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-97780High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97779Medium
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. The attacker can read data outside the intended memory bounds.
Original NVD description (English source)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS