CVE-2026-44818

HighCVSS 7.0/10Last modified Jul 23, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-448197.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-44825.5The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users ha CVE-2026-448207.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-448215.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-448228.2Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-448237.8Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-448247.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-448259.8Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 CVE-2026-448267.5Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not CVE-2026-448278.8Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trus CVE-2026-448289.3Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without au CVE-2026-448298.8Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filep