CVE-2026-55948 - Microsoft Excel Remote Code Execution Vulnerability - is a use-after-free issue in Microsoft Excel that can lead to remote code execution. Microsoft rates it as CVSS v3.1 base 7.8 (High) with a temporal score of 6.8; the vector is local attack, low complexity, no privileges required, and user interaction required. Microsoft reports no public disclosure, no known exploitation, and exploit code maturity is unproven; exploitation is rated unlikely. Because the attack requires a user to open a malicious Office file and the Preview Pane is not an attack vector, enterprise risk is centered on phishing-delivered local execution rather than network-exposed services.

Highlights:
- CVSS scores: Base 7.8 - Temporal 6.8
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Remote Code Execution with HIGH confidentiality, integrity, and availability impacts.
- Exploitation likelihood: Exploitation Unlikely; vector is LOCAL with LOW attack complexity, NO privileges required, and user interaction REQUIRED.
- Severity for enterprise: High technical severity, but lower than network-reachable RCE because exploitation is local and requires the victim to open a malicious file.
- Patch status: available; customer action required.

Affected systems:
- Microsoft Excel