{"id":"CVE-2026-68801","state":"PUBLISHED","title":"Microsoft Excel Remote Code Execution Vulnerability","description":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.","publishedAt":"2026-08-11T17:07:06.513Z","updatedAt":"2026-10-28T20:08:31.481Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft 365 Apps for Enterprise","Microsoft Microsoft Excel 2016","Microsoft Microsoft Office 2019","Microsoft Microsoft Office 365 for Mac","Microsoft Microsoft Office LTSC 2021","Microsoft Microsoft Office LTSC 2024","Microsoft Microsoft Office LTSC for Mac 2021","Microsoft Microsoft Office LTSC for Mac 2024","Microsoft Office Online Server"],"affected":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Excel 2016","versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.5565.1001","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 2019","versions":[{"version":"19.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 365 for Mac","versions":[{"version":"1.0.0","status":"affected","lessThan":"16.112.26081010","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.112.26081010","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.112.26081010","versionType":"custom"}]},{"vendor":"Microsoft","product":"Office Online Server","versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.10417.20175","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68801"],"weaknesses":["CWE-122"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68801.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68801","state":"PUBLISHED","datePublished":"2026-08-11T17:07:06.513Z","dateUpdated":"2026-10-28T20:08:31.481Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2026-07-31T16:41:44.242Z"},"containers":{"cna":{"title":"Microsoft Excel Remote Code Execution Vulnerability","descriptions":[{"lang":"en-US","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally."}],"affected":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Excel 2016","versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.5565.1001","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 2019","versions":[{"version":"19.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 365 for Mac","versions":[{"version":"1.0.0","status":"affected","lessThan":"16.112.26081010","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.112.26081010","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.112.26081010","versionType":"custom"}]},{"vendor":"Microsoft","product":"Office Online Server","versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.10417.20175","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68801","name":"Microsoft Excel Remote Code Execution Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"CWE-122: Heap-based Buffer Overflow","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-10-28T20:08:31.481Z"},"datePublic":"2026-08-11T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"16.112.26081010"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:ltsc:*:*:*","versionStartIncluding":"16.0.0.0","versionEndExcluding":"16.0.10417.20175"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"19.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.112.26081010"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.112.26081010"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:excel_2016:*:*:*:*:*:*:x86:*","versionStartIncluding":"16.0.0.0","versionEndExcluding":"16.0.5565.1001"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-07T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-68801"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-12T03:57:46.193Z"}}]}}}