CVE-2026-124229

MediumCVSS 6.6/10Last modified Nov 10, 2026

Description

Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-124237.5A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semCVE-2026-1242336.5Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-124247.2The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4CVE-2026-1242496.3http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and PCVE-2026-124256.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access CenCVE-2026-1242507.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory CVE-2026-1242518.8Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.CVE-2026-1242537.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Calculated Fields Form calcCVE-2026-1242555.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events-made-easy alloCVE-2026-1242566.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRockz Delivery & Pickup Date TCVE-2026-1242576.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-CVE-2026-1242585.3Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Contro
CVE-2026-124229: Medium severity, CVSS 6.6 | Vulnix