CVE-2026-44817: Microsoft Excel Remote Code Execution Vulnerability

Synopsis

An integer underflow vulnerability in Microsoft Excel allows an attacker to execute arbitrary code on the victim's machine. The attack is local and requires no prior authentication, but the victim must open a malicious Excel file, making it a file-based social-engineering attack. Successful exploitation gives the attacker full code execution with the privileges of the user running Excel. Patched-image rebuilds at versions 16.0.5556.1001 and 16.0.10417.20137 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host, or delivers a malicious file through other means; no network-exposed service is targeted directly.

• AuthenticationNot required

  No account or credentials on the target system are required before exploitation; the attacker relies entirely on file delivery to the victim.

• Victim interactionRequired

  The victim must open a specially crafted Excel file, making this a social-engineering attack (for example, a phishing email with a malicious attachment).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors beyond the victim opening the file.

Blast Radius

• The attacker executes arbitrary code in the context of the user running Excel, gaining the same file-system and process permissions as that user.
• Confidential documents, saved credentials, and other files accessible to the user account are readable by the attacker.
• The attacker can write or modify files on the host, including dropping persistent payloads or altering application data.
• The Excel process and dependent functionality can be crashed or destabilized, disrupting the user's work session.