CVE-2026-108444HighCVSS 8.8
Microsoft Office Remote Code Execution Vulnerability
🔗 CVE IDs covered (1)
📋 Description
Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.
How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted file and convince a user to open it in Microsoft Excel and save it as a web page. Successful exploitation could allow the attacker to execute code in the user's context.
🎯 Affected products9
- Microsoft 365 Apps for Enterprise for 32-bit Systems
- Microsoft 365 Apps for Enterprise for 64-bit Systems
- Microsoft Office 365 for Mac
- Microsoft Office LTSC 2021 for 32-bit editions
- Microsoft Office LTSC 2021 for 64-bit editions
- Microsoft Office LTSC 2024 for 32-bit editions
- Microsoft Office LTSC 2024 for 64-bit editions
- Microsoft Office LTSC for Mac 2021
- Microsoft Office LTSC for Mac 2024
✅ Remediation
KBRelease Notes (Security Update) — fixed build https://aka.ms/OfficeSecurityReleases KBRelease Notes (Security Update) — fixed build 16.114.26101123 KBRelease Notes (Security Update) — fixed build 16.0.14334.20974 KBRelease Notes (Security Update) — fixed build 16.0.17932.21056
🔗 References (4)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108444
- patchhttps://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
- patchhttps://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac
- patchhttps://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates