CVE-2026-65807

A type confusion vulnerability in Excel's file parsing allows remote code execution when a user opens a malicious workbook. The parser expects one data type but receives another, enabling memory corruption and execution hijacking. The attack surface here is a direct consequence of Excel's decades-old file format complexity. The parser must handle legacy XLS files, VBA macros, external data connections, OLE embedding, and modern OOXML—creating a state space where objects can arrive in more configurations than developers can model. Type validation accumulated organically rather than being systematically designed, leaving unchecked assumptions scattered across dozens of code paths. The CVSS/EPSS disconnect is notable. A score of 8.8 implies high severity, but exploitation probability is low—meaning either the chain is difficult or meaningful preconditions exist. Here, the precondition is explicit: the victim must open a malicious file. Email filtering, safe attachment scanning, and macro blocking directly neutralize this vector. For organizations with mature email security, the actual operational risk differs substantially from what the headline score suggests. The more insidious risk is propagation through Excel's object model. Type confusion doesn't just crash the parser—it can create an apparently-valid object that flows into the calculation engine, VBA runtime, or external data connections. The blast radius extends beyond the initial file: a corrupted object can spread through legitimate workbooks opened subsequently, creating ambiguous trust states across a user's session. Additionally, type confusion CVEs in document parsers cluster historically. One fix tends to reveal 3-7 parallel vulnerabilities within eighteen months—not from regression, but because the fix exposes how many sibling type assumptions were already flawed. When one validation gap closes, auditors discover structurally similar gaps in parallel paths handling analogous data structures. The remediation window matters: variant discovery is predictable in this class, meaning patching speed is more critical than typical. Prioritize safe attachment scanning and macro blocking at the email gateway, since user interaction is required. Patch aggressively in the first weeks after release—this is one vulnerability class where the follow-on CVE pattern is well-documented.

Reviewed through automated stages and approved by a human before publication.