CVE-2026-20955
Published: 13 January 2026
Summary
CVE-2026-20955 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the untrusted pointer dereference vulnerability in Microsoft Office Excel by requiring identification, reporting, and timely application of vendor patches.
Implements memory protection mechanisms like DEP, ASLR, and stack guards to prevent arbitrary code execution from untrusted pointer dereferences in Excel.
Deploys malicious code protection at endpoints to scan, detect, and block malicious Excel files exploiting the pointer dereference before user interaction.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct arbitrary code execution via crafted malicious Excel file opened by user maps to client-side exploitation and malicious file execution techniques.
NVD Description
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2026-20955 is an untrusted pointer dereference vulnerability (CWE-822) in Microsoft Office Excel. It enables an unauthorized attacker to execute code locally on affected systems. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-01-13T18:16:23.307.
Exploitation requires local access to the target system, low attack complexity, no user privileges, and user interaction, such as opening a malicious Excel file. A successful attack allows the unauthorized attacker to achieve high-impact effects on confidentiality, integrity, and availability, resulting in arbitrary code execution within the context of the affected application.
The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20955.
Details
- CWE(s)