CVE-2026-55948

HighCVSS 7.8/10Last modified Jul 16, 2026

Description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Microsoft	Microsoft 365 Apps for Enterprise	>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Excel 2016	>= 16.0.0.0, < 16.0.5561.1001
Microsoft	Microsoft Office 2019	>= 19.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office 365 for Mac	>= 1.0.0, < 16.111.26071215
Microsoft	Microsoft Office LTSC 2021	>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC 2024	>= 16.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC for Mac 2021	>= 16.0.1, < 16.111.26071215
Microsoft	Microsoft Office LTSC for Mac 2024	>= 16.0.0, < 16.111.26071215
Microsoft	Office Online Server	>= 16.0.0.0, < 16.0.10417.20175

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55948Patch, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Jul 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-559497.8Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-55956.3A security vulnerability has been detected in griptape-ai griptape 0.19.4. Affected by this vulnerability is the function load_files_from_di CVE-2026-559505.9Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remot CVE-2026-559518.2The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size CVE-2026-559527.5The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key CVE-2026-559537.4The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was amo CVE-2026-559549.1Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The U CVE-2026-559556.5Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. CVE-2026-559566.5Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or CVE-2026-559577.3Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI CVE-2026-559587.5Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag CVE-2026-55966.3A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools