CVE-2026-45469: Microsoft Excel Remote Code Execution Vulnerability

Synopsis

An integer underflow vulnerability in Microsoft Excel allows an attacker to execute arbitrary code on the victim's machine. The attack is local and requires no authentication, but the victim must open a specially crafted Excel file, making this a file-based social-engineering exploit. Successful exploitation gives the attacker full code execution with the privileges of the user running Excel, enabling complete compromise of confidentiality, integrity, and availability of that user's environment. Patched-image rebuilds at versions 16.0.5556.1001 and 16.0.10417.20137 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-accessible service is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are required; the attacker only needs to get a crafted file in front of the victim.

• Victim interactionRequired

  The victim must open a malicious Excel file, which requires a social-engineering step such as a phishing email or a malicious download.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the victim opening the file.

Blast Radius

• Reads files and data accessible to the user running Excel, including stored credentials, documents, and session tokens.
• Writes or modifies files and registry entries within the user's permissions, allowing persistence mechanisms or data tampering.
• Crashes or disrupts the Excel process and potentially other processes running under the same user context.
• Executes arbitrary code at the victim user's privilege level, enabling installation of malware or lateral movement within the host.