PT-2026-24317 · Microsoft · Office Excel

F4 + 2 · Published 2026-03-10 · Updated 2026-04-07 · CVE-2026-26107

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel (affected versions not specified) Microsoft Office Microsoft 365 Apps for Enterprise Microsoft Office Online Server

Description A use-after-free issue exists in Microsoft Office Excel, Microsoft Office, Microsoft 365 Apps for Enterprise, and Microsoft Office Online Server. This flaw could allow an unauthorized attacker to execute code locally. The vulnerability enables remote attackers to execute arbitrary code and affect the system. The issue involves the use of memory after it has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-02975

CVE-2026-26107

Affected Products

Office Excel

References · 10

• https://safe-surf.ru/specialists/bulletins-nkcki/729785 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26107 · Security Note
• https://msrc.microsoft.com/update-guide/advisory/CVE-2026-26107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26107 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02975 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26107 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26107 · Security Note
• https://t.me/avleonovcom/1637 · Telegram Post
• https://twitter.com/RedHornet_Intel/status/2041626989459583306 · Twitter Post
• https://twitter.com/CVEnew/status/2033361120270901400 · Twitter Post