CVE-2026-26112
Published: 10 March 2026
Summary
CVE-2026-26112 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 9.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26112 is an untrusted pointer dereference vulnerability (CWE-822; NVD-CWE-Other) affecting Microsoft Office Excel. Published on 2026-03-10, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw enables an unauthorized attacker to execute code locally through improper handling of untrusted pointers.
Exploitation requires local access to the target system (AV:L) with low attack complexity (AC:L) and no privileges (PR:N), but relies on user interaction (UI:R), such as opening a malicious Excel document. Successful exploitation grants the attacker arbitrary code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U).
Microsoft's advisory provides mitigation details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26112. Security practitioners should consult this resource for patch availability and recommended actions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10678
Vulnerability details
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a client-side RCE flaw in Excel triggered by opening a malicious document (local access + UI:R), directly enabling T1203 (Exploitation for Client Execution) and facilitating T1204.002 (User Execution: Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-26112 by requiring timely application of Microsoft patches to remediate the untrusted pointer dereference flaw in Office Excel.
Implements memory protections like DEP, ASLR, and CFG that prevent arbitrary code execution from untrusted pointer dereferences in Excel.
Deploys anti-malware scanning for malicious Excel documents that exploit the untrusted pointer dereference vulnerability.