The vulnerability is a stack-based buffer overflow, tracked as CWE-121. Microsoft’s advisory is explicit about the required attack chain: the attacker must send a malicious Office file and convince its recipient to open it. The advisory also says the Preview Pane is not an attack vector, so merely selecting or previewing an attachment does not trigger this specific vulnerability.
Microsoft labels the issue “remote code execution,” but its CVSS attack vector is local. In Microsoft’s terminology, remote describes where the attacker may be located rather than execution occurring over the network without user involvement. The payload runs locally on the victim’s machine after the malicious file is opened; Microsoft notes this form of exploit is sometimes called Arbitrary Code Execution, or ACE.
CVE-2026-68817 severity and attack requirements
CVE-2026-68817 carries the CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The rating reflects low attack complexity, no privileges required, mandatory user interaction, and potential high impact to confidentiality, integrity, and availability within the affected security authority.
The practical administrative conclusion is straightforward: this is an email- and document-delivery risk, not a Preview Pane risk. File filtering, attachment inspection, and user training remain useful layers, but they do not replace installing Microsoft’s fixes because the vulnerable parsing path is reached when a user opens the booby-trapped file.
Microsoft’s published status fields are:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment should help prioritize deployment sequencing, but it is not a reason to defer patching systems that routinely receive spreadsheets or other Office documents from outside the organization.
Microsoft’s advisory clarifies the “remote” label
Microsoft describes the flaw as follows: “Microsoft Office Excel Remote Code Execution Vulnerability: Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.”
The advisory’s additional detail rules out a common concern for Office attachment vulnerabilities. “Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.” Organizations that have Preview Pane restrictions or attachment-preview controls should retain them for other risks, but those controls do not address the opening action required for CVE-2026-68817.
Microsoft also answers the user-interaction component directly: “According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? An attacker must send a user a malicious Office file and convince them to open it.” The absence of a privilege requirement means the user does not need administrator rights for exploitation to pose a serious endpoint risk.
For the local-vector terminology, Microsoft states: “According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.”
Affected Office products and fixed builds
The MSRC advisory covers current Microsoft 365 Apps, perpetual Office releases, Mac releases, and Office Online Server. The remediation differs by servicing model: Excel 2016 and Office Online Server have named KB packages and fixed build numbers, Mac products have a specific fixed build, while Microsoft 365 Apps and Windows editions of Office 2019 and Office LTSC point administrators to the Office security-release servicing channel.
For Microsoft 365 Apps for Enterprise for 32-bit Systems (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft 365 Apps for Enterprise for 64-bit Systems (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Excel 2016 (32-bit edition) (x86), install KB5002903 to reach fixed build 16.0.5565.1001.
For Microsoft Excel 2016 (64-bit edition) (x64), install KB5002903 to reach fixed build 16.0.5565.1001.
For Microsoft Office 2019 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office 2019 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office 365 for Mac, update to fixed build 16.112.26081010 or later.
For Microsoft Office LTSC 2021 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2021 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2024 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2024 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC for Mac 2021, update to fixed build 16.112.26081010 or later.
For Microsoft Office LTSC for Mac 2024, update to fixed build 16.112.26081010 or later.
For Office Online Server, install KB5002884 to reach fixed build 16.0.10417.20175.
The KB-to-build mapping needs verification in patch reports
The most concrete deployment checks are available for the products with individual KB packages. Microsoft maps KB5002903 to fixed build 16.0.5565.1001 for both Microsoft Excel 2016 (32-bit edition) (x86) and Microsoft Excel 2016 (64-bit edition) (x64). Office Online Server requires KB5002884 and fixed build 16.0.10417.20175.
Mac administrators should verify 16.112.26081010 or later across Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The same Mac build threshold across subscription and LTSC products makes version reporting especially important where devices are managed separately from Windows Office deployments.
For Windows deployments using Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, or Microsoft Office LTSC 2024, the advisory supplies the Office security-release destination rather than a single numeric build in the affected-product mapping. Administrators should therefore confirm that their configured Office update channel has delivered the relevant security release, rather than treating a generic “Office updated” inventory state as sufficient evidence of remediation.
What administrators should do now
Security teams should identify managed and unmanaged installations of the 14 affected product entries, with particular attention to Excel 2016, Office Online Server, and Macs that may not follow the same update workflow as Windows endpoints. The attack requires a user to open a malicious Office file, making users who receive externally supplied spreadsheets, financial models, reports, and shared business documents the most immediate exposure group.
Patch compliance should be measured against the named fixed versions where Microsoft provides them: 16.0.5565.1001 for Microsoft Excel 2016, 16.0.10417.20175 for Office Online Server, and 16.112.26081010 for the affected Mac products. For the remaining Windows Office products, administrators need to apply the applicable Office security release or later and validate that managed update channels are functioning.
CVE-2026-68817 does not turn the Preview Pane into an execution path, but it leaves users exposed once they open a weaponized Office file on an unpatched system. Microsoft’s customer-action designation means the operational task is to deploy the applicable Office update and verify the fixed build across every affected servicing model.
