Cyber Resilience

CVE-2026-20956

High

Published: 13 January 2026

Published
13 January 2026
Modified
14 January 2026
KEV Added
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0007 22.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20956 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 22.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-20956, published on 2026-01-13, is an untrusted pointer dereference vulnerability (CWE-822) affecting Microsoft Office Excel. The issue enables an unauthorized attacker to execute code locally and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impacts on confidentiality, integrity, and availability.

Exploitation requires local access to the target system (AV:L) with low complexity (AC:L) and no privileges (PR:N), but relies on user interaction (UI:R), such as opening a malicious Excel document. A successful attack allows arbitrary code execution in the context of the user without scope change (S:U), potentially compromising the local system with high confidentiality, integrity, and availability impacts.

Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20956.

EU & UK References

Vulnerability details

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Vulnerability enables local arbitrary code execution via malicious Excel document (user interaction), directly mapping to client-side exploitation and malicious file execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-21363Same product: Microsoft 365 Apps
CVE-2025-24083Same product: Microsoft 365 Apps
CVE-2025-26629Same product: Microsoft 365 Apps
CVE-2025-21397Same product: Microsoft 365 Apps
CVE-2026-20955Same product: Microsoft 365 Apps
CVE-2026-20949Same product: Microsoft 365 Apps
CVE-2025-21381Same product: Microsoft 365 Apps
CVE-2026-20948Same product: Microsoft 365 Apps
CVE-2026-26112Same product: Microsoft 365 Apps
CVE-2026-40367Same product: Microsoft 365 Apps

Affected Assets

microsoft
365 apps
all versions
microsoft
office long term servicing channel
2021, 2024

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Flaw remediation requires applying Microsoft patches for the untrusted pointer dereference in Excel, directly eliminating the vulnerability and preventing local code execution.

prevent

Memory protection safeguards such as DEP, ASLR, and stack canaries mitigate untrusted pointer dereference exploits by preventing unauthorized code execution in Excel processes.

preventdetect

Malicious code protection scans and blocks malicious Excel documents exploiting the untrusted pointer dereference before they can trigger code execution.

References