## Summary
CVE-2026-68798 describes a heap-based buffer overflow in Microsoft Office Excel that can allow an unauthorized attacker to execute code locally. The NVD indicates the issue is reachable with no privileges required (PR:N) but requires user interaction (UI:R).
## Technical Details
- Vulnerability type: Heap-based buffer overflow
- CWE: CWE-122
- Affected component: Microsoft Office Excel
- Impacted security properties (per CVSS): confidentiality, integrity, and availability (C:H, I:H, A:H)
## Affected
- Microsoft Office Excel (exact product/build/version details not available from provided sources)
## Impact
- Local attacker can potentially achieve code execution on the affected system.
- The CVSS vector indicates:
- AV:L (local access)
- AC:L (low attack complexity)
- PR:N (no privileges required)
- UI:R (user interaction required)
- S:U (scope unchanged)
- C:H, I:H, A:H (high impact on confidentiality, integrity, and availability)
## Mitigation
1. Apply vendor security updates/patches for Microsoft Office Excel as soon as available (no specific fixed version was provided in the available material).
2. Reduce exposure to untrusted Excel content by restricting or sandboxing opening of files from external sources.
3. Monitor for suspicious Excel activity and unexpected process behavior following user interaction with Office documents (no detection indicators were provided in the available material).
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-122