Microsoft Office Excel Use-After-Free Flaw Rated CVSS 8.8

Microsoft has disclosed a high-severity use-after-free vulnerability in Excel that lets an unauthorized attacker execute code over a network.

The vulnerability carries a CVSS 3.1 base score of 8.8. The vector string is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. It was published to the CVE list on August 3, 2026 and added to the NVD dataset the following day.

Affected products span multiple versions of Microsoft Office and Excel. Impacted releases include Microsoft 365 Apps for Enterprise targeting both 32-bit and 64-bit platforms where version 16.0.1 falls below the security update available at https://aka.ms/OfficeSecurityReleases. Microsoft Excel 2016 for 32-bit and x64-based platforms is affected from version 16.0.0.0 up to but not including 16.0.5561.1001.

Microsoft Office 2019 targeting 32-bit and x64 platforms is listed as affected for version 19.0.0 below the same security release threshold. Microsoft Office LTSC 2021 for 32-bit and x64 platforms is affected for version 16.0.1 below the security update. Microsoft Office LTSC 2024 for 32-bit and x64 platforms is affected for version 16.0.0 below the security update.

The flaw is classified as CWE-416 Use After Free. The description states that the use-after-free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The record was received from Microsoft Corporation on August 3, 2026 at 8:17:37 PM.

Microsoft has published an update guide for the issue. The advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62870. No CVSS 4.0 or CVSS 2.0 assessment has been provided by NVD at the time of publication. Microsoft also lists the same vulnerability in Microsoft Office LTSC 2024.