CVE-2026-97742 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft released a security update on October 13, 2026, addressing CVE-2026-97742, a remote code execution vulnerability affecting Microsoft Office Excel. The vulnerability is caused by a stack-based buffer overflow that could allow an unauthenticated attacker to execute malicious code when a user opens a specially crafted Office file. With low attack complexity and no authentication required, the vulnerability presents a significant risk to organizations that regularly exchange spreadsheets through email, collaboration platforms, and shared storage. Successful exploitation could expose sensitive business information, disrupt operations, and potentially provide attackers with a foothold inside corporate networks.

CVSS Score: 8.8

SEVERITY: CVSS v3.1 severity label not available in the Metrics.

Threat

The primary threat is remote code execution through malicious Office files opened in vulnerable Microsoft Excel applications.

An attacker could create a specially crafted Office file and deliver it through email, shared storage, or other business communication channels. If an employee opens the file, the vulnerability could be triggered, potentially allowing the attacker to execute unauthorized code on the affected system.

The attacker does not need valid credentials or existing access to the target computer. However, exploitation requires the victim to open the malicious document.

This creates a significant risk for organizations where employees routinely receive financial statements, invoices, payroll reports, and operational spreadsheets from external sources.

Exploits

• Publicly Disclosed: No
• Actively Exploited: No
• Public Proof-of-Concept (PoC): Not confirmed; exploit code maturity is listed as Unproven.
• Exploitability Assessment: Exploitation Less Likely

The Preview Pane is not an attack vector for this vulnerability. An attacker must convince a user to open a malicious Office file.

Although Microsoft considers exploitation less likely, the low attack complexity and absence of authentication requirements create a potential risk through phishing and malicious document delivery.

Technical Summary

CVE-2026-97742 is a stack-based buffer overflow vulnerability, classified as CWE-121, affecting Microsoft Office Excel.

A stack-based buffer overflow occurs when software writes more data into a memory buffer on the program’s stack than the buffer can safely hold. This can overwrite nearby memory, corrupt application data, and potentially interfere with program execution.

In this case, an attacker could create a specially crafted Office file designed to trigger the memory corruption weakness when processed by Microsoft Excel.

If a user opens the malicious file and exploitation succeeds, the attacker could execute unauthorized code on the affected system. The exact internal exploitation mechanism and execution privileges are not specified in the available vulnerability information.

The CVSS v3.1 metrics identify several important characteristics:

• Attack Vector: Network, allowing malicious Office files to be delivered remotely.
• Attack Complexity: Low, indicating exploitation does not require unusually complex conditions.
• Privileges Required: None, meaning attackers do not need authenticated access.
• User Interaction: Required, because the victim must open the malicious Office file.
• Scope: Unchanged, meaning the impact remains within the affected security authority.
• Confidentiality: High, indicating potentially serious exposure of sensitive information.
• Integrity: High, indicating the possibility of unauthorized changes to files or system resources.
• Availability: High, indicating potentially serious disruption to affected systems.

Successful exploitation could allow attackers to execute malicious programs, access confidential business information, modify important documents, or interrupt normal system operations.

Exploitability

Affected Microsoft products include:

• Microsoft 365 Apps for Enterprise: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2021: 32-bit and 64-bit editions.
• Microsoft Office LTSC for Mac: 2021 and 2024.
• Microsoft Office 365 for Mac.
• Office Online Server.

An unauthenticated attacker could attempt exploitation by sending a specially crafted Office file and convincing a user to open it. The Preview Pane is not an attack vector.

The security updates for Microsoft Office LTSC for Mac 2021 and 2024 were not immediately available at the time of publication. Microsoft indicated that customers would be notified when the updates become available.

Business Impact

CVE-2026-97742 represents a significant security risk for organizations that rely on Microsoft Excel for financial reporting, budgeting, data analysis, and everyday business operations.

Excel spreadsheets are commonly exchanged between employees, customers, suppliers, and business partners. Attackers could disguise malicious Office files as legitimate invoices, financial statements, payment requests, or operational reports to convince employees to open them.

Because attackers do not need authentication and attack complexity is low, a successful phishing attempt could potentially result in unauthorized code execution and additional system compromise.

Potential business consequences include:

• Unauthorized System Compromise: Attackers could execute malicious code on affected computers.
• Sensitive Data Exposure: Confidential financial records, customer information, and internal business documents could potentially be accessed or stolen.
• Malware and Ransomware Deployment: Compromised systems could potentially be used to install additional malicious software.
• Financial Data Manipulation: Attackers could modify important spreadsheets, financial records, or operational reports.
• Operational Disruption: Successful exploitation could interrupt employee productivity and essential business processes.
• Lateral Movement: Attackers could potentially use compromised systems to target additional resources within corporate networks.
• Financial and Reputational Damage: Security incidents could result in recovery expenses, business downtime, and loss of customer confidence.

“When spreadsheets carry the financial and operational information that keeps a business running, one malicious document could put much more than a single workstation at risk.”

Workaround

Until the official Microsoft security updates can be deployed, organizations should consider the following risk-reduction measures:

• Avoid opening unsolicited or suspicious Excel and Office files.
• Block or quarantine potentially malicious Office attachments using email security controls.
• Use Protected View and other available Microsoft Office security protections.
• Apply least-privilege controls and restrict access to untrusted documents.
• Monitor security update availability for Microsoft Office LTSC for Mac 2021 and 2024.
• Deploy the appropriate Microsoft Office security updates promptly.

These measures may reduce exposure but are not confirmed fixes for the underlying vulnerability.

Urgency

CVE-2026-97742 has a Critical maximum severity rating in Microsoft’s vulnerability information and a CVSS v3.1 base score of 8.8, reflecting the potentially serious consequences of successful remote code execution.

The vulnerability is particularly concerning because attackers do not need authentication, attack complexity is low, and malicious Office files can be distributed through familiar business communication channels.

Although Microsoft considers exploitation less likely and reports no known active exploitation, a successful attack could compromise confidential business information, interrupt important operations, and create opportunities for additional attacks.

Organizations should prioritize identifying affected Microsoft Office installations, deploying available October 2026 security updates, and strengthening defenses against malicious Office attachments.

Special attention should be given to Microsoft Office LTSC for Mac 2021 and 2024 because security updates were not immediately available at the time of publication.

“When opening one spreadsheet could lead to malicious code execution, timely patching helps prevent an everyday document from becoming a costly security incident.”