CVE-2016-7262highunder attack

CVE-2016-7262

Published · Updated

Follow this CVE+ Monitor Microsoft Excel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 59%
from disclosure to weapon
Published on NVDDec 20
CISA KEV+1899d
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

A vulnerability in Microsoft Excel allows attackers to bypass security features and execute harmful commands when a user clicks on a specially crafted cell in a spreadsheet. This is dangerous because it can let attackers take control of your computer through a malicious Excel file.

Technical detail

Microsoft Excel versions 2007-2016 and Office Compatibility Pack fail to properly validate crafted cells, allowing user-assisted remote code execution through a security feature bypass. The attack requires user interaction (clicking the cell) and affects multiple Excel versions; successful exploitation results in arbitrary command execution with user privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Security Feature Bypass Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a