CVE-2026-97739 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has identified a critical Remote Code Execution (RCE) vulnerability in Microsoft Office Excel that could allow an unauthorized attacker to execute malicious code on a vulnerable system. The vulnerability is caused by an integer underflow that can lead to a heap-based buffer overflow. An attacker could exploit this weakness by convincing a user to open a specially crafted Office file. Successful exploitation could compromise system confidentiality, integrity, and availability. Although Microsoft considers exploitation less likely, the vulnerability carries a CVSS score of 8.8 and requires urgent patching consideration due to its critical severity and potential business impact.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk because attackers could potentially execute unauthorized code through a malicious Office document.

The attack does not require administrative privileges or an existing account on the targeted system. However, it does require user interaction, specifically opening a malicious Office file.

The vulnerability has the following characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

A successful attack could allow malicious code to run on a vulnerable system, potentially resulting in sensitive information exposure, unauthorized system modifications, or operational disruption.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication:

• Publicly Disclosed: No
• Actively Exploited: No
• Exploit Code Maturity: Unproven
• Zero-Day Exploitation: No known active exploitation is reported.
• Public Proof-of-Concept (PoC): The existence of publicly available PoC exploit code is not confirmed.

There is currently no reported evidence of active exploitation in the wild.

However, the vulnerability has low attack complexity and requires no privileges, making it a potentially attractive target for attackers.

Technical Summary

CVE-2026-97739 is a critical Remote Code Execution vulnerability affecting Microsoft Office Excel.

The vulnerability involves an integer underflow (CWE-191) and a heap-based buffer overflow (CWE-122).

An integer underflow occurs when a mathematical operation produces a value below the minimum value supported by its data type. This can cause the value to wrap around unexpectedly.

In vulnerable applications, incorrect integer calculations can lead to improper memory management and potentially cause a heap-based buffer overflow.

A heap-based buffer overflow occurs when an application writes data beyond the allocated memory boundaries, potentially corrupting memory and creating opportunities for malicious code execution.

For this vulnerability, an attacker could create a specially crafted Microsoft Office document designed to trigger the underlying memory-handling weakness.

The attack scenario involves three main stages:

1. An attacker prepares a malicious Office file containing specially crafted content.

2. The attacker delivers the file to a targeted user and convinces them to open it.

3. Opening the malicious document could trigger the vulnerability and allow unauthorized code execution.

The vulnerability can be exploited over a network, but successful exploitation requires user interaction.

The Microsoft Office Preview Pane is not an attack vector for this vulnerability. The targeted user must open the malicious Office file.

Successful exploitation could have serious consequences, including:

• Unauthorized execution of malicious code.
• Exposure of confidential business information.
• Modification or destruction of important files.
• Installation of additional malicious software.
• Disruption of affected systems and business operations.

The vulnerability has a CVSS base score of 8.8 and a temporal score of 7.7.

Microsoft has released an official fix.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise: 32-bit and 64-bit systems.
• Microsoft Office 365 for Mac.
• Microsoft Office LTSC 2021: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: 32-bit and 64-bit editions.
• Microsoft Office LTSC for Mac 2021.
• Microsoft Office LTSC for Mac 2024.
• Office Online Server: Security update KB5002928.

The specific affected build ranges are not identified.

An attacker could exploit the vulnerability by convincing a user to open a malicious Office document.

No prior privileges are required, but user interaction is necessary.

Microsoft rates exploitation as less likely.

Business Impact

This vulnerability represents a serious risk to organizations that rely on Microsoft Excel and Office applications for daily business activities.

Because Excel files are frequently exchanged through email and other communication channels, malicious documents could become an effective delivery method for attackers.

A trusted-looking spreadsheet could become an entry point for a major security incident.

If successfully exploited, the vulnerability could cause several business consequences:

• Sensitive Data Exposure: Attackers could potentially access confidential financial records, customer information, or internal business documents.
• System Compromise: Unauthorized code execution could allow attackers to perform malicious activities on affected systems.
• Operational Disruption: Compromised systems could experience instability, application failures, or interruptions to critical business processes.
• Financial Loss: Security incidents could result in recovery expenses, operational downtime, and potential financial damage.
• Reputational Damage: Exposure of sensitive information could reduce customer confidence and damage organizational credibility.

The vulnerability’s high impact ratings across confidentiality, integrity, and availability highlight the potential seriousness of a successful attack.

One compromised document could put sensitive business information and critical operations at risk.

Organizations with large Microsoft Office deployments should prioritize identifying affected systems and applying the appropriate security updates.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

Until security updates can be installed, organizations should consider these precautionary measures:

• Avoid opening unexpected or suspicious Office attachments.
• Verify the legitimacy of Office documents received from unknown or untrusted sources.
• Educate employees about malicious document attacks and phishing attempts.
• Monitor endpoints for suspicious Office application activity.
• Restrict access to untrusted Office documents where operationally feasible.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Applying the official Microsoft security update remains the recommended remediation.

Urgency

Critical Severity – Prioritize Security Patch Deployment

CVE-2026-97739 should receive high deployment priority because it allows potential remote code execution and carries a critical severity rating with a CVSS score of 8.8.

Although active exploitation has not been reported and Microsoft considers exploitation less likely, the vulnerability has several concerning characteristics.

It requires no prior privileges, has low attack complexity, and could be triggered when a user opens a specially crafted Office document.

These characteristics make it particularly concerning for organizations where employees regularly exchange Excel spreadsheets and other Office documents.

A successful attack could compromise sensitive information, affect system integrity, and interrupt business operations.

The danger is not just opening a malicious spreadsheet; it is what attackers could do after gaining code execution on a business system.

Organizations should prioritize patch deployment across affected Microsoft 365, Office LTSC, and Office Online Server environments.

Microsoft has issued an official fix, and customer action is required.

Recommended Action: Deploy the applicable Microsoft security updates as soon as possible, prioritizing business-critical systems and users who regularly handle external Office documents.

—