CVE-2026-44823: Microsoft Excel Remote Code Execution Vulnerability

Synopsis

An integer underflow vulnerability in Microsoft Excel allows an attacker to trigger arbitrary code execution on the local machine. The attack is local in delivery and requires no prior authentication, but does require the victim to open a malicious file. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at versions 16.0.5556.1001 and 16.0.10417.20137 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-accessible service is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are required before the attack can begin; the vulnerability is reachable by any unauthenticated local context.

• Victim interactionRequired

  The victim must open a specially crafted Excel file, making this a social-engineering vector that relies on file delivery via email, download, or shared storage.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special race conditions, memory-layout knowledge, or environmental setup beyond delivering the malicious file.

Blast Radius

• The attacker executes arbitrary code in the context of the user who opened the file, giving full control over that user session.
• All files and data readable by the victim user can be accessed and exfiltrated.
• The attacker can modify or delete files, registry entries, and persisted data accessible to the victim account.
• The affected Excel process and any dependent services can be crashed or made unavailable.