CVE-2026-55948

HighCVSS 7.8/10Last modified Jul 16, 2026

Description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-559497.8Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-55956.3A security vulnerability has been detected in griptape-ai griptape 0.19.4. Affected by this vulnerability is the function load_files_from_diCVE-2026-559505.9Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remotCVE-2026-559518.2The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size CVE-2026-559527.5The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key CVE-2026-559537.4The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was amoCVE-2026-559549.1Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The UCVE-2026-559556.5Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. CVE-2026-559566.5Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method orCVE-2026-559577.3Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI CVE-2026-559587.5Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag CVE-2026-55966.3A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools
CVE-2026-55948: High severity, CVSS 7.8 | Vulnix