THE CIRCUITRYYour one-stop source for all tech news

Home/Tech/Microsoft Office Excel Use-After-Free Flaw Rated CVSS 8.8

VERIFIEDBy Xavier Rivera· ·1.5 min read

Microsoft Office Excel Use-After-Free Flaw Rated CVSS 8.8

Microsoft disclosed CVE-2026-62870, a use-after-free vulnerability in Excel rated CVSS 8.8 that allows remote code execution over a network. The flaw affects multiple supported versions of Microsoft 365 Apps, Excel 2016, Office 2019, and LTSC editions and was published August 3, 2026.

Source:NVD

Post

Microsoft Office Excel Use-After-Free Flaw Rated CVSS 8.8

TL;DRAI · 60 sec read

Microsoft has disclosed a high-severity use-after-free vulnerability in Excel that lets an unauthorized attacker execute code over a network.

The vulnerability carries a CVSS 3.1 base score of 8.8. The vector string is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. It was published to the CVE list on August 3, 2026 and added to the NVD dataset the following day.

Affected products span multiple versions of Microsoft Office and Excel.

Affected products span multiple versions of Microsoft Office and Excel. Impacted releases include Microsoft 365 Apps for Enterprise targeting both 32-bit and 64-bit platforms where version 16.0.1 falls below the security update available at https://aka.ms/OfficeSecurityReleases. Microsoft Excel 2016 for 32-bit and x64-based platforms is affected from version 16.0.0.0 up to but not including 16.0.5561.1001.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

Microsoft Office 2019 targeting 32-bit and x64 platforms is listed as affected for version 19.0.0 below the same security release threshold. Microsoft Office LTSC 2021 for 32-bit and x64 platforms is affected for version 16.0.1 below the security update. Microsoft Office LTSC 2024 for 32-bit and x64 platforms is affected for version 16.0.0 below the security update.

The description states that the use-after-free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

The flaw is classified as CWE-416 Use After Free. The description states that the use-after-free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The record was received from Microsoft Corporation on August 3, 2026 at 8:17:37 PM.

Microsoft has published an update guide for the issue. The advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62870. No CVSS 4.0 or CVSS 2.0 assessment has been provided by NVD at the time of publication. Microsoft also lists the same vulnerability in Microsoft Office LTSC 2024.

EXPERT TAKE

Enterprise security teams should prioritize the Office security release referenced in the advisory to close network-attack paths on affected Excel deployments.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

Microsoft Excel Vulnerability Security

MORE IN TECH

Tesla and SpaceX confirm Terafab chip fab in Texas

Tesla and SpaceX have confirmed Grimes County, Texas as the site for their Terafab semiconductor megafactory, with the first phase costing roughly $16.8 billion. The project targets the largest chip manufacturing facility on the planet to supply over 1 terawatt of compute per year that exceeds current and future global production capacity.

OpenAI Urges Federal Judge to Throw Out Apple's Trade Secrets Complaint

OpenAI has filed a motion asking a federal judge to dismiss Apple's trade secrets lawsuit, describing the claims as meritless. The dispute, which follows a July suit and this week's injunction request from Apple, highlights tensions after their prior partnership on Siri and OpenAI's hardware push.

Meta introduces Muse Code, its terminal-based coding agent

Meta has released an early beta of Muse Code, a terminal-based coding agent driven by the updated Muse Spark 1.2 model and positioned against Anthropic's Claude Code and OpenAI's Codex. Substantially lower rates, including a contributor plan at $0.10 for every million tokens received, may encourage migration away from higher-priced options such as Anthropic's Sonnet 5.