CVE-2026-97741 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft released a security update on October 13, 2026, addressing CVE-2026-97741, a remote code execution vulnerability affecting Microsoft Office Excel. The vulnerability involves a heap-based buffer overflow and an off-by-one error that could allow an unauthenticated attacker to execute malicious code when a user opens a specially crafted Office file. With low attack complexity and no authentication required, the vulnerability creates a significant risk for organizations that regularly exchange spreadsheets through email, collaboration platforms, and shared storage. Successful exploitation could expose sensitive information, disrupt business operations, and potentially provide attackers with a foothold inside corporate networks.

CVSS Score: 8.8

SEVERITY: CVSS v3.1 severity label not available in the supplied Metrics.

Threat

The primary threat is remote code execution through malicious Office files opened in vulnerable Microsoft Excel applications.

An attacker could create a specially crafted Office file and distribute it through email, file-sharing services, or other business communication channels. If an employee opens the file, the vulnerability could be triggered, potentially allowing malicious code to execute on the affected system.

The attacker does not need valid credentials or existing access to the target computer. However, exploitation requires the victim to open the malicious file.

This is particularly concerning for organizations where employees regularly exchange financial statements, invoices, payroll reports, and operational spreadsheets with external parties.

Exploits

• Publicly Disclosed: No
• Actively Exploited: No
• Public Proof-of-Concept (PoC): Not confirmed; exploit code maturity is listed as Unproven.
• Exploitability Assessment: Exploitation Less Likely

The Preview Pane is not an attack vector for this vulnerability. An attacker must convince a user to open a malicious Office file.

Although Microsoft considers exploitation less likely, the low attack complexity and lack of authentication requirements create a potential risk through phishing and malicious document delivery.

Technical Summary

CVE-2026-97741 involves two memory safety weaknesses affecting Microsoft Office Excel: a heap-based buffer overflow (CWE-122) and an off-by-one error (CWE-193).

A heap-based buffer overflow occurs when software writes more data into a dynamically allocated memory area than that area can safely contain. This can corrupt adjacent memory, interfere with normal application behavior, and potentially allow an attacker to execute unauthorized code.

An off-by-one error occurs when software incorrectly calculates a boundary or processes one more or one fewer element than intended. In memory-handling operations, this can result in writing beyond an allocated buffer.

In this case, a specially crafted Office file could trigger unsafe memory operations when processed by Microsoft Excel. Successful exploitation could allow an attacker to execute malicious code on the affected system.

The exact relationship between the two weaknesses, the internal exploitation method, and the privileges gained are not specified in the vulnerability information.

The CVSS v3.1 metrics identify several important attack characteristics:

• Attack Vector: Network, allowing malicious Office files to be delivered remotely.
• Attack Complexity: Low, indicating exploitation does not require unusually complex conditions.
• Privileges Required: None, meaning attackers do not need authenticated access.
• User Interaction: Required, because the victim must open the malicious Office file.
• Scope: Unchanged, meaning the impact remains within the affected security authority.
• Confidentiality: High, indicating potentially serious exposure of sensitive information.
• Integrity: High, indicating the possibility of unauthorized changes to files or system resources.
• Availability: High, indicating potentially serious disruption to affected systems.

Successful exploitation could allow attackers to run malicious programs, access confidential business information, modify important documents, or interrupt normal system operations.

Exploitability

Affected Microsoft products identified in the available security update information include:

• Microsoft 365 Apps for Enterprise: 32-bit and 64-bit editions.
• Microsoft Office LTSC for Mac: 2021 and 2024.
• Microsoft Office 365 for Mac.

Specific vulnerable build ranges are not identified in the available information.

An unauthenticated attacker could attempt exploitation by sending a specially crafted Office file and convincing a user to open it. The Preview Pane is not an attack vector.

The security updates for Microsoft Office LTSC for Mac 2021 and 2024 were not immediately available at the time of publication. Microsoft indicated that customers would be notified when the updates become available.

Business Impact

CVE-2026-97741 represents a serious security concern for organizations that depend on Microsoft Excel for financial reporting, budgeting, operational planning, and everyday business activities.

Excel documents are routinely exchanged between employees, customers, suppliers, and business partners. Attackers could disguise malicious Office files as legitimate invoices, financial statements, payment requests, or operational reports to convince employees to open them.

Because attackers do not need authentication and the attack complexity is low, a successful phishing attempt could potentially result in unauthorized code execution and broader system compromise.

Potential business consequences include:

• Unauthorized System Compromise: Attackers could execute malicious code on affected computers.
• Sensitive Data Exposure: Confidential financial records, customer information, and internal business documents could potentially be accessed or stolen.
• Malware and Ransomware Deployment: Compromised systems could potentially be used to install additional malicious software.
• Financial Data Manipulation: Attackers could modify important spreadsheets, business records, or operational reports.
• Operational Disruption: Successful exploitation could interrupt employee productivity and essential business processes.
• Lateral Movement: Attackers could potentially use compromised systems to target additional resources within corporate networks.
• Financial and Reputational Damage: Security incidents could result in recovery expenses, downtime, and loss of customer confidence.

“When spreadsheets hold the financial and operational information that drives a business, one malicious document could put much more than a single workstation at risk.”

Workaround

Until the official Microsoft security updates can be deployed, organizations should consider the following risk-reduction measures:

• Avoid opening unsolicited or suspicious Excel and Office files.
• Block or quarantine potentially malicious Office attachments using email security controls.
• Use Protected View and other available Microsoft Office security protections.
• Apply least-privilege controls and restrict access to untrusted documents.
• Monitor security update availability for Microsoft Office LTSC for Mac 2021 and 2024.
• Deploy the appropriate Microsoft Office security updates promptly.

These measures may reduce exposure but are not confirmed Microsoft workarounds for the underlying vulnerability.

Urgency

CVE-2026-97741 has a Critical maximum severity rating in the supplied Microsoft vulnerability information and a CVSS v3.1 base score of 8.8, indicating potentially serious consequences if remote code execution is achieved.

The vulnerability is particularly concerning because attackers do not need authentication, attack complexity is low, and malicious Office documents can be distributed through familiar business communication channels.

Although Microsoft considers exploitation less likely and reports no known active exploitation, a successful attack could compromise confidential business information, interrupt operations, and potentially create opportunities for additional attacks.

Organizations should prioritize identifying affected Microsoft Office installations, deploying available October 2026 security updates, and strengthening protections against malicious Office attachments.

Additional attention should be given to Microsoft Office LTSC for Mac 2021 and 2024 because security updates were not immediately available at the time of publication.

“When opening one spreadsheet could lead to malicious code execution, timely patching helps prevent an everyday document from becoming a costly business security incident.”