CVE-2026-21259 - Vulnerability Details - OpenCVE

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	365 Apps Excel 2016 Office 2019 Office 2021 Office 2024

No data.

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21259

History

Tue, 10 Feb 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.
Title		Microsoft Excel Elevation of Privilege Vulnerability
First Time appeared		Microsoft Microsoft 365 Apps Microsoft excel 2016 Microsoft office 2019 Microsoft office 2021 Microsoft office 2024
Weaknesses		CWE-122
CPEs		cpe:2.3:a:microsoft:365_apps:::::enterprise:::* cpe:2.3:a:microsoft:excel_2016:::::::x86:* cpe:2.3:a:microsoft:office_2019:::::::: cpe:2.3:a:microsoft:office_2021:::::long_term_servicing_channel:::* cpe:2.3:a:microsoft:office_2021:::::ltsc:::* cpe:2.3:a:microsoft:office_2024:::::long_term_servicing_channel:::*
Vendors & Products		Microsoft Microsoft 365 Apps Microsoft excel 2016 Microsoft office 2019 Microsoft office 2021 Microsoft office 2024
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21259
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-02-10T17:51:17.445Z

Updated: 2026-02-11T01:14:41.684Z

Reserved: 2025-12-11T21:02:05.737Z

Link: CVE-2026-21259

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-02-10T18:16:27.790

Modified: 2026-02-10T21:51:48.077

Link: CVE-2026-21259

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21259", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-12-11T21:02:05.737Z", "datePublished": "2026-02-10T17:51:17.445Z", "dateUpdated": "2026-02-11T01:14:41.684Z"}, "containers": {"cna": {"title": "Microsoft Excel Elevation of Privilege Vulnerability", "datePublic": "2026-02-10T08:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:ltsc:*:*:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.10417.20097"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel_2016:*:*:*:*:*:*:x86:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.5539.1002"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Office Online Server", "versions": [{"version": "16.0.0.0", "lessThan": "16.0.10417.20097", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office 2019", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "19.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "platforms": ["x64-based Systems", "32-bit Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2024", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Excel 2016", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.0.0", "lessThan": "16.0.5539.1002", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-122: Heap-based Buffer Overflow", "lang": "en-US", "type": "CWE", "cweId": "CWE-122"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-02-11T01:14:41.684Z"}, "references": [{"name": "Microsoft Excel Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21259"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}}}