CVE-2026-81950CriticalRevised 17 Sep

Microsoft Excel Remote Code Execution Vulnerability

Assessment

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Severity: Critical
CVSS base score: 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact: Remote Code Execution
EPSS, next 30 days: 0.5%Higher than 37.9% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation Less Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Microsoft Office Excel
Weakness: CWE-415: Double Free
Issued by: Microsoft
Published: 8 Sep 2026 · September 2026
Last revised: 17 Sep 2026Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft Office software do not need to take any actio…

2 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5002904	Security Update	—	Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition)	All CVEs in KB5002904
KB5002914	Security Update	—	Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition)	All CVEs in KB5002914

Microsoft Office

15 affected products