7.8

CVE-2026-20957

Microsoft Excel Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ 365 Apps Version - SwEdition enterprise HwPlatform x64
Microsoft ≫ 365 Apps Version - SwEdition enterprise HwPlatform x86
Microsoft ≫ Excel Version 2016
Microsoft ≫ Office Version 2019
Microsoft ≫ Office Long Term Servicing Channel Version 2021 SwPlatform - HwPlatform x64
Microsoft ≫ Office Long Term Servicing Channel Version 2021 SwPlatform - HwPlatform x86
Microsoft ≫ Office Long Term Servicing Channel Version 2021 SwPlatform macos
Microsoft ≫ Office Long Term Servicing Channel Version 2024 SwPlatform - HwPlatform x64
Microsoft ≫ Office Long Term Servicing Channel Version 2024 SwPlatform - HwPlatform x86
Microsoft ≫ Office Long Term Servicing Channel Version 2024 SwPlatform macos
Microsoft ≫ Office Online Server Version < 16.0.10417.20083
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.383
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Microsoft 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-122 Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

CWE-191 Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20957
Vendor Advisory