The flaw is an untrusted pointer dereference in Microsoft Office Excel that allows an attacker to execute arbitrary code on the victim’s machine when an Excel file containing malicious content is opened, potentially compromising confidentiality, integrity, and availability.

Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are all affected; all current releases of these products lack the fix for CVE-2026-20956.

With a CVSS score of 7.8 and an EPSS below 1%, the vulnerability presents a moderate to high severity but a low probability of exploitation; it is not listed in the CISA KEV catalog. Attackers would require a malicious workbook or attachment that a user opens, thus the attack vector is local, through user interaction, and the vulnerability is mitigated through patching. The impact of successful exploitation would be execution of code with the privileges of the logged‑in user, enabling full system compromise.