{"id":"CVE-2026-70254","published":"2026-10-13T19:19:43.687","lastModified":"2026-10-15T21:17:43.400","description":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-125"],"vendors":["microsoft"],"products":["365 apps","microsoft 365","office 2021","office 2024"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70254","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer over-read vulnerability in Microsoft Excel allows remote attackers to execute arbitrary code when opening malicious Excel files. This occurs due to improper bounds checking when processing certain file structures, potentially enabling attackers to gain full control of affected systems.","exploitability":"Exploitation requires a user to open a specially crafted malicious Excel file, making it moderately difficult to achieve but possible through social engineering or phishing campaigns.","blast_radius":"If exploited, this vulnerability could allow attackers to execute code on user workstations with the privileges of the logged-in user, potentially leading to full system compromise and data exfiltration across Microsoft 365 and Office applications.","remediation":"Deploy the Microsoft Excel update KB5041078 or later to address this vulnerability in affected Office versions.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","excel","office","remote"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:56:09.053Z"}}