CVE-2026-32199

High

Published: 14 April 2026

Published

14 April 2026

Modified

17 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0007 21.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32199 is a high-severity Use After Free (CWE-416) vulnerability. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 21.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-32199 is a use-after-free vulnerability (CWE-416) affecting Microsoft Office Excel. Published on 2026-04-14T18:17:26.710, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The issue enables an unauthorized attacker to execute code locally by exploiting memory management flaws in the Excel component.

Exploitation requires local access to the target system and user interaction, such as opening a specially crafted Excel file, with low attack complexity and no privileges needed from the attacker. Upon success, the attacker achieves arbitrary code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability.

Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-22583

Vulnerability details

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CWE(s): CWE-416

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

Why these techniques?

Use-after-free in Excel enables arbitrary code execution via opening a crafted file, mapping directly to client-side exploitation (T1203) and malicious file user execution (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1