CVE-2026-44820: Microsoft Excel Remote Code Execution Vulnerability

Synopsis

An integer underflow vulnerability in Microsoft Excel allows an attacker to execute arbitrary code on the local machine. The attack is launched locally and requires no prior authentication, but the victim must open a specially crafted Excel file. Successful exploitation gives the attacker full code execution in the context of the logged-in user, enabling data theft, file modification, or further system compromise. Patched-image rebuilds at versions 16.0.5556.1001 and 16.0.10417.20137 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credential is required before attempting exploitation; the attack is available to any unprivileged local party.

• Victim interactionRequired

  The victim must open a malicious Excel file, making this a social-engineering vector where the attacker must deliver a crafted document.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other environmental preconditions.

Blast Radius

• Reads files and data accessible to the logged-in user, including documents, credentials stored on disk, and session material.
• Writes or modifies files in any location the victim user can access, including configuration files and scripts.
• Executes arbitrary processes under the victim user account, enabling installation of persistence mechanisms or lateral-movement tooling.
• Crashes or destabilizes the Excel process and any dependent workflows running under the same user session.