---
id: "CVE-2026-124229"
page: "https://infrastack.ai/live/CVE-2026-124229"
kind: "vulnerability"
aliases: ["CVE-2026-124229"]
title: "Microsoft Excel: untrusted data deserialization lets an attacker run code"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["microsoft-excel", "microsoft-office", "other", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:50+00:00"
first_seen_at: "2026-11-10T19:25:14+00:00"
updated_at: "2026-11-10T19:55:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124229", "first_seen_at": "2026-11-10T19:25:14+00:00"}]
exploit_sources: []
---

# Microsoft Excel: untrusted data deserialization lets an attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-124229 (this .md is for agents)

Microsoft Office Excel deserializes untrusted data without checking it, which can let an unauthorized attacker execute code. The NVD description says the attack is physical, meaning the attacker needs access to the machine or device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:25:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124229

## From the sources

Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_