CVE-2026-44818: Microsoft Excel Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Other sources
Microsoft Excel Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.110.26061317 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5556.1001Patch KB5002877 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20137Patch KB5002875
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44818?
CVE-2026-44818 has a high severity rating of 7.
How do I fix CVE-2026-44818?
Fixing CVE-2026-44818 typically involves applying the latest security updates provided by Microsoft for your affected Excel application.
What types of software are affected by CVE-2026-44818?
CVE-2026-44818 affects Microsoft Excel 2016, Microsoft 365 Apps for Enterprise, Microsoft Office Online Server, Microsoft 365 Apps, Microsoft Excel, Microsoft Office 2019, Microsoft Office 2021, and Microsoft Office 2024.
What is the risk associated with CVE-2026-44818?
The risk associated with CVE-2026-44818 is categorized with a risk score of 62, indicating substantial potential impact.
How can an attacker exploit CVE-2026-44818?
An attacker can exploit CVE-2026-44818 through an integer underflow vulnerability to execute code locally on an affected machine.