{"id":"CVE-2026-124229","kind":"vulnerability","aliases":["CVE-2026-124229"],"related":[],"title":"Microsoft Excel: untrusted data deserialization lets an attacker run code","description":"Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.","summary":"Microsoft Office Excel deserializes untrusted data without checking it, which can let an unauthorized attacker execute code. The NVD description says the attack is physical, meaning the attacker needs access to the machine or device.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-excel","microsoft-office","other","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:50+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":"2026-11-10T19:55:57+00:00","updated_at":"2026-11-10T19:55:57+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:55:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Excel: untrusted data deserialization lets an attacker run code","impact":"high","summary":"Microsoft Office Excel deserializes untrusted data without checking it, which can let an unauthorized attacker execute code. The NVD description says the attack is physical, meaning the attacker needs access to the machine or device.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-excel","microsoft-office","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs code on the machine with physical access","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-124229 for affected Excel builds, fixed versions and whether the attack really needs physical access.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":4500,"output_tokens":377,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124229':13A,16A '-2026':12A,15A 'access':54B 'allow':68C 'attack':8A,39B,47B,52B,71C,78C 'check':32B 'code':10A,41B,74C 'cve':11A,14A 'data':4A,30B,63C 'descript':44B 'deseri':5A,28B,60C 'devic':59B 'excel':2A,19B,27B,67C 'execut':40B,73C 'let':6A,36B 'machin':57B 'mean':50B 'microsoft':1A,18B,21B,25B,65C 'microsoft-excel':17B 'microsoft-offic':20B 'need':53B 'nvd':43B 'offic':22B,26B,66C 'physic':49B,77C 'run':9A 'say':45B 'unauthor':38B,70C 'untrust':3A,29B,62C 'window':24B 'without':31B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","microsoftexcel","microsoftoffice","other","windows"],"campaign_type":null,"search_a":"'-124229':13A,16A '-2026':12A,15A 'attack':8A 'code':10A 'cve':11A,14A 'data':4A 'deseri':5A 'excel':2A 'let':6A 'microsoft':1A 'run':9A 'untrust':3A","search_b":"'access':54B 'attack':39B,47B,52B 'check':32B 'code':41B 'data':30B 'descript':44B 'deseri':28B 'devic':59B 'excel':19B,27B 'execut':40B 'let':36B 'machin':57B 'mean':50B 'microsoft':18B,21B,25B 'microsoft-excel':17B 'microsoft-offic':20B 'need':53B 'nvd':43B 'offic':22B,26B 'physic':49B 'say':45B 'unauthor':38B 'untrust':29B 'window':24B 'without':31B","search_c":"'allow':68C 'attack':71C,78C 'code':74C 'data':63C 'deseri':60C 'excel':67C 'execut':73C 'microsoft':65C 'offic':66C 'physic':77C 'unauthor':70C 'untrust':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124229","severity":null,"published_at":"2026-11-10T19:20:50+00:00","modified_at":"2026-11-10T19:20:50+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}