CVE-2026-44820ImportantRevised 19 Jun

Microsoft Excel Remote Code Execution Vulnerability

MSRC advisory NVD CVE.org

Assessment

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Severity: Important
CVSS base score: 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact: Remote Code Execution
EPSS, next 30 days: 0.5%Higher than 37.9% of scored CVEs · FIRST model run 29 Sep 2026 · about EPSS
Public exploit code: No Nuclei template lists it
Exploitability: Exploitation Less Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Microsoft Office Excel
Weakness: CWE-125: Out-of-bounds Read
Issued by: Microsoft
Published: 9 Jun 2026 · June 2026
Last revised: 19 Jun 2026Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft Office software do not need to take any actio…

2 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5002875	Security Update	—	Office Online Server	All CVEs in KB5002875
KB5002877	Security Update	—	Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition)	All CVEs in KB5002877

14 affected products