## Summary
CVE-2026-68804 describes a numeric truncation error in Microsoft Office Excel that can allow an unauthorized attacker to execute code locally. The issue is classified as high severity (CVSS 7.8) with a local attack vector.
## Technical Details
- Root cause class: numeric truncation error (CWE-122).
- Impact type: local code execution in Microsoft Office Excel.
- CVSS vector indicates:
- AV:L (local access)
- PR:N (no privileges required)
- UI:R (user interaction required)
- C:H, I:H, A:H (high impact on confidentiality, integrity, and availability).
## Affected
- Microsoft Office Excel (specific product editions/versions not provided in the available data).
## Impact
- Local code execution in the context of the affected Excel component.
- Potential for full compromise outcomes consistent with C:H/I:H/A:H (high confidentiality/integrity/availability impact).
## Mitigation
1. Apply Microsoft security updates/patches for the affected Excel component as soon as they are available.
2. Reduce exposure to untrusted local files by restricting who can open documents and by using application allowlisting where feasible.
3. Monitor for suspicious Excel activity following user interaction with untrusted spreadsheets (e.g., unexpected process spawning), and investigate according to your incident response procedures.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-122