CVE-2026-21259
Published: 10 February 2026
Summary
CVE-2026-21259 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires organizations to identify, report, and correct flaws such as the heap-based buffer overflow in Excel, directly preventing exploitation through timely patching.
Implements memory protections like address space layout randomization and data execution prevention to block unauthorized code execution from heap buffer overflows in Excel.
Deploys malicious code protection mechanisms to scan for and block malicious Excel files exploiting the vulnerability before user interaction.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap overflow in Excel enables client-side code execution via malicious file (T1203/T1204.002) leading directly to local privilege escalation (T1068).
NVD Description
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-21259, published on 2026-02-10, is a heap-based buffer overflow vulnerability in Microsoft Office Excel. It is linked to CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An unauthorized attacker with local access can exploit this vulnerability to elevate privileges. Exploitation requires low complexity and user interaction, such as opening a malicious Excel file, but no prior privileges. Successful exploitation can result in high impacts to confidentiality, integrity, and availability.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21259.
Details
- CWE(s)