CVE-2026-97745 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has identified a critical Remote Code Execution (RCE) vulnerability in Microsoft Office Excel that could allow an unauthorized attacker to execute malicious code on a vulnerable system. The vulnerability, tracked as CVE-2026-97745, is caused by a Use-After-Free (UAF) memory management flaw. An attacker could exploit this weakness by convincing a user to open a specially crafted malicious Office file. Successful exploitation could compromise sensitive information, enable unauthorized system modifications, or disrupt business operations. Although exploitation is considered less likely and no active exploitation has been reported, the vulnerability carries a high CVSS score of 8.8 and affects multiple Microsoft Office products.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk because attackers could execute malicious code through a specially crafted Microsoft Office file.

An attacker does not need existing privileges on the targeted system. However, successful exploitation requires a user to open a malicious Office document.

The attack has low complexity and can potentially compromise the confidentiality, integrity, and availability of affected systems.

The primary risks include:

• Unauthorized Code Execution: Attackers could execute malicious instructions on vulnerable systems.
• Sensitive Data Exposure: Confidential business information could be accessed or stolen.
• System Compromise: Successful exploitation could allow unauthorized modifications to affected systems.
• Business Disruption: Compromised systems could interrupt normal business activities and affect productivity.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

• Publicly Disclosed: No
• Actively Exploited: No
• Exploit Code Maturity: Unproven

There is no confirmed evidence of active exploitation or publicly available proof-of-concept (PoC) exploit code.

The vulnerability is not identified as an actively exploited zero-day.

However, the low attack complexity and lack of required attacker privileges make this vulnerability a potential target for future attacks.

Technical Summary

CVE-2026-97745 is a critical Remote Code Execution vulnerability in Microsoft Office Excel caused by a Use-After-Free (CWE-416) memory management weakness.

A Use-After-Free vulnerability occurs when an application attempts to access memory that has already been released. This can lead to unpredictable application behavior, memory corruption, and potentially unauthorized code execution.

In this case, an attacker could exploit the vulnerability by creating a specially crafted Microsoft Office file designed to trigger the memory management flaw.

The attack follows these steps:

1. An attacker prepares a malicious Office document containing content designed to exploit the vulnerability.

2. The attacker sends the document to a targeted user.

3. The attacker convinces the user to open the malicious file.

4. Opening the file could trigger the Use-After-Free condition.

5. Successful exploitation could allow the attacker to execute malicious code on the affected system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Importantly, the Microsoft Office Preview Pane is not an attack vector for this vulnerability.

An attacker must convince the targeted user to open the malicious Office file.

Successful exploitation could result in unauthorized code execution, potentially allowing attackers to access sensitive information, modify system resources, or disrupt affected applications.

Microsoft has confirmed the vulnerability and identified an official fix.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise – 32-bit and 64-bit systems
• Microsoft Office LTSC 2021 – 32-bit and 64-bit editions
• Microsoft Office LTSC 2024 – 32-bit and 64-bit editions

An attacker could exploit the vulnerability by convincing a user to open a specially crafted malicious Office file.

No attacker privileges are required, but user interaction is necessary.

Microsoft considers exploitation less likely.

Specific vulnerable build numbers and fixed build versions are not confirmed.

Business Impact

This vulnerability poses a serious risk to organizations that rely on Microsoft Excel for daily business operations.

Excel files are commonly exchanged through email and other business communication channels, making malicious Office documents a potential method for targeting employees.

A successful attack could have several consequences:

• Data Breaches: Attackers could gain unauthorized access to confidential business information, financial records, or sensitive organizational data.
• System Compromise: Malicious code execution could compromise affected workstations and undermine system security.
• Operational Disruption: Exploitation could interrupt business processes and reduce employee productivity.
• Financial Losses: Security incidents could result in recovery expenses, operational downtime, and potential financial damage.
• Reputational Damage: Exposure of sensitive information could reduce customer confidence and harm business relationships.

A single malicious spreadsheet could turn a routine business task into a serious security incident.

Because Excel is widely used across business environments, organizations should prioritize protecting affected installations.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

Until the security update is deployed, organizations should consider these precautionary measures:

• Avoid opening unexpected or suspicious Office attachments.
• Verify the source of Office documents before opening them.
• Educate employees about malicious document attacks.
• Use existing email security controls to help detect suspicious attachments.
• Deploy Microsoft’s official security fix as soon as possible.

These precautions may reduce exposure but do not eliminate the vulnerability.

Urgency

Critical – Prioritize Security Patch Deployment

CVE-2026-97745 requires urgent patching because it could allow remote code execution through a malicious Microsoft Office file.

Although Microsoft considers exploitation less likely and no active exploitation has been reported, the vulnerability presents substantial security risks.

Several factors increase the importance of timely remediation:

• Critical Severity: The vulnerability carries a CVSS base score of 8.8.
• Remote Code Execution: Successful exploitation could allow attackers to execute malicious code.
• Low Attack Complexity: Exploitation does not require complex attack conditions.
• No Privileges Required: Attackers do not need existing access privileges.
• High Potential Impact: Confidentiality, integrity, and availability could all be significantly affected.
• Multiple Affected Products: Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 are affected.

Organizations should prioritize deploying Microsoft’s official security fix across affected Office installations.

Delaying this patch leaves a critical weakness in one of the most widely used business applications.

Early remediation can reduce the risk of system compromise, sensitive data exposure, and operational disruption.