CVE-2026-97753 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has released a security update on October 13, 2026, addressing CVE-2026-97753, a Critical remote code execution vulnerability affecting Microsoft Office Excel. The vulnerability involves a heap-based buffer overflow and integer overflow or wraparound weakness that could allow an unauthenticated attacker to execute malicious code when a user opens a specially crafted Office file. With low attack complexity and no attacker privileges required, this vulnerability presents a significant risk to organizations that routinely exchange spreadsheets through email and collaboration platforms. Successful exploitation could compromise sensitive information, disrupt business operations, and provide attackers with a foothold inside corporate networks.

CVSS Score: 8.8

SEVERITY: Not specified in the CVSS:3.1 Metrics.

Threat

The primary threat is remote code execution through malicious Office files processed by vulnerable Microsoft Excel components.

An attacker could create a specially crafted Office file and convince a user to open it. Once the malicious file is processed, the vulnerability could potentially allow unauthorized code execution on the affected system.

Unlike attacks that require an attacker to obtain credentials or privileged access, this vulnerability requires no authentication. However, successful exploitation depends on a user opening the malicious file.

This is particularly concerning for organizations where employees regularly work with financial reports, invoices, operational spreadsheets, and documents received from external business partners.

Exploits

• Publicly Disclosed: No
• Actively Exploited: No
• Public Proof-of-Concept (PoC): Not confirmed; exploit code maturity is listed as Unproven.
• Exploitability Assessment: Exploitation Less Likely

Microsoft reports that exploitation is less likely, and the available vulnerability information does not identify known active exploitation.

The Preview Pane is not an attack vector for this vulnerability. An attacker must convince a user to open the malicious Office file.

Technical Summary

CVE-2026-97753 is a remote code execution vulnerability involving two memory safety weaknesses in Microsoft Office Excel: a heap-based buffer overflow (CWE-122) and an integer overflow or wraparound condition (CWE-190).

A heap-based buffer overflow occurs when software writes data beyond the boundaries of an allocated memory area, potentially corrupting adjacent memory structures.

An integer overflow or wraparound occurs when a numerical calculation exceeds the range supported by a variable. This can produce incorrect values and potentially lead to unsafe memory operations.

These weaknesses could potentially be triggered when Excel processes a specially crafted Office file. If exploitation succeeds, an attacker could execute unauthorized code on the affected system.

The exact relationship between the two weaknesses and the internal exploitation mechanism are not specified in the vulnerability information.

The CVSS v3.1 metrics identify several important attack characteristics:

• Attack Vector: Network, allowing malicious Office files to be delivered remotely.
• Attack Complexity: Low, indicating exploitation does not require unusually complex conditions.
• Privileges Required: None, meaning the attacker does not need an authenticated account.
• User Interaction: Required, because the victim must open the malicious Office file.
• Scope: Unchanged, meaning the impact remains within the affected security authority.
• Confidentiality: High, indicating potentially serious exposure of sensitive information.
• Integrity: High, indicating the possibility of unauthorized modification of files and system resources.
• Availability: High, indicating potentially serious disruption to affected systems.

Successful exploitation could allow an attacker to execute malicious programs, access confidential documents, modify business information, or interfere with normal system operations. The exact privileges gained are not specified.

Exploitability

Affected Microsoft products include:

• Microsoft 365 Apps for Enterprise: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2021: 32-bit and 64-bit editions.
• Microsoft Office LTSC for Mac: 2021 and 2024.
• Microsoft Office 365 for Mac.
• Office Online Server.

An unauthenticated attacker could attempt exploitation by sending a malicious Office file and convincing a user to open it. The Preview Pane cannot trigger this vulnerability.

The security updates for Microsoft Office LTSC for Mac 2021 and 2024 were not immediately available at the time of publication. Microsoft indicated that they would be released later.

Business Impact

CVE-2026-97753 represents a significant security risk for organizations that rely on Microsoft Excel for financial management, business reporting, data analysis, and everyday operations.

Excel files are routinely exchanged between employees, customers, suppliers, and business partners. Attackers could exploit these familiar workflows by disguising malicious files as invoices, financial statements, payroll reports, or operational documents.

Because exploitation requires no attacker authentication and has low attack complexity, a convincing phishing message or compromised business communication could potentially lead to successful exploitation.

Potential business consequences include:

• Unauthorized System Compromise: Attackers could execute malicious code on affected systems.
• Sensitive Data Exposure: Confidential financial records, customer information, and business documents could potentially be accessed or stolen.
• Malware and Ransomware Deployment: A compromised workstation could potentially be used to install malicious software.
• Financial Data Manipulation: Attackers could alter spreadsheets, business records, or other important information.
• Operational Disruption: Successful attacks could interrupt employee productivity and critical business processes.
• Lateral Movement: Compromised systems could potentially provide attackers with opportunities to target additional corporate resources.
• Financial and Reputational Damage: Security incidents could result in recovery costs, downtime, and loss of customer confidence.

“When spreadsheets contain the numbers that drive a business, a malicious Excel file could threaten much more than one computer.”

Workaround

Until the official Microsoft security updates can be deployed, organizations should consider these risk-reduction measures:

• Avoid opening unsolicited or suspicious Excel and Office files.
• Block or quarantine potentially malicious Office attachments using email security controls.
• Use Protected View and other Office security protections where available.
• Restrict access to untrusted files and apply least-privilege controls.
• Monitor Microsoft Office security update availability, particularly for Office LTSC for Mac 2021 and 2024.
• Deploy the appropriate security updates as soon as they become available.

These measures may reduce exposure but are not confirmed fixes for the underlying vulnerability.

Urgency

CVE-2026-97753 carries a Critical maximum severity rating and a CVSS v3.1 base score of 8.8, reflecting the potentially serious consequences of successful remote code execution.

The vulnerability is particularly concerning because attackers do not need authentication, attack complexity is low, and malicious Office documents can be delivered through common business communication channels.

Although Microsoft considers exploitation less likely and reports no known active exploitation, successful exploitation could compromise confidential information, interrupt business operations, and create opportunities for additional attacks.

Organizations should prioritize identifying affected Microsoft Office installations, deploying available October 2026 security updates, and strengthening controls against malicious Office attachments.

Special attention should be given to Microsoft Office LTSC for Mac 2021 and 2024 because security updates were not immediately available at the time of publication.

“A spreadsheet should help run the business, not become a gateway for attackers. Patching Excel reduces the risk of one malicious file turning into a costly security incident.”