CVE-2026-97755 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has addressed a Critical Remote Code Execution (RCE) vulnerability in Microsoft Office Excel that could allow an unauthorized attacker to execute malicious code by tricking a user into opening a specially crafted Office file. The vulnerability, identified as CVE-2026-97755, results from an out-of-bounds read weakness in Excel. An attacker could exploit this vulnerability remotely without requiring authentication or existing privileges. However, successful exploitation requires a user to open a malicious document. With a CVSS score of 8.8, this vulnerability poses a significant risk to organizations using affected Microsoft Office products, potentially leading to unauthorized code execution, sensitive data exposure, and system compromise.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a serious security threat because attackers could use malicious Office documents to compromise vulnerable systems.

An attacker could distribute a specially crafted Excel file through email or other file-sharing methods and convince an employee to open it.

Once the malicious document is opened, successful exploitation could allow the attacker to execute code on the affected system.

The vulnerability is particularly concerning because attackers do not need existing privileges, and the attack complexity is rated Low.

Successful exploitation could result in:

• Unauthorized execution of malicious code.
• Exposure or theft of confidential business information.
• Compromise of affected systems and business applications.
• Disruption of business operations and employee productivity.
• Loss of data integrity and system availability.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication, the vulnerability was not publicly disclosed and had not been reported as exploited in the wild.

The exploit code maturity is classified as Unproven, meaning there is no confirmed evidence of working exploit code.

The existence of publicly available proof-of-concept (PoC) exploit code cannot be confirmed.

Although there are no reported active attacks, the vulnerability remains concerning because exploitation requires no existing privileges and has low attack complexity.

An attacker must convince a user to open a malicious Office file to trigger the vulnerability.

Technical Summary

CVE-2026-97755 is a Critical Remote Code Execution vulnerability affecting Microsoft Office Excel.

The underlying weakness is identified as CWE-125: Out-of-bounds Read.

An out-of-bounds read occurs when an application attempts to access memory outside the boundaries of an allocated memory region.

In this case, the weakness in Microsoft Office Excel could allow an unauthorized attacker to execute malicious code remotely.

The attack requires the following conditions:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

An attacker must create a malicious Office document and persuade the targeted user to open it.

Opening the malicious file could trigger the vulnerability and potentially allow unauthorized code execution.

Importantly, the Microsoft Office Preview Pane is not an attack vector for this vulnerability. The user must open the malicious document.

The vulnerability has a high potential impact on confidentiality, integrity, and availability, meaning successful exploitation could expose sensitive information, compromise data integrity, or disrupt affected systems.

Microsoft has released an official fix to address this security issue.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit).
• Microsoft Office 365 for Mac.
• Microsoft Office LTSC 2021 (32-bit and 64-bit).
• Microsoft Office LTSC 2024 (32-bit and 64-bit).
• Microsoft Office LTSC for Mac 2021 and 2024.
• Microsoft SharePoint Server Subscription Edition.
• Office Online Server.

Exploitation requires a malicious Office file to be opened by a user.

Attackers do not require authentication or existing privileges.

Microsoft rates exploitation as Less Likely, and no active exploitation has been reported.

Business Impact

This vulnerability creates a significant risk for organizations because Microsoft Office applications are widely used for everyday business activities.

Employees frequently open spreadsheets and Office documents received through email, collaboration platforms, and external business communications.

This creates opportunities for attackers to distribute malicious documents disguised as legitimate business files.

If successfully exploited, the vulnerability could allow attackers to execute unauthorized code on affected systems.

Potential business consequences include:

• Sensitive Data Exposure: Confidential financial records, customer information, and internal business documents could be exposed.
• System Compromise: Attackers could execute malicious code and compromise affected endpoints.
• Operational Disruption: Compromised systems could become unavailable, affecting employee productivity and business operations.
• Financial Loss: Security incidents could create costs associated with investigation, recovery, and business downtime.
• Reputational Damage: A successful security breach could damage customer confidence and business relationships.

The vulnerability is especially concerning for organizations that regularly exchange Office documents with external parties.

“A single malicious spreadsheet could become an entry point for attackers, putting business systems, sensitive information, and daily operations at risk.”

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

Until the security update can be deployed, organizations should consider the following precautions:

• Avoid opening unexpected or suspicious Office attachments.
• Educate employees about malicious documents and phishing attempts.
• Restrict Office files received from untrusted sources.
• Use email security controls to detect suspicious attachments.
• Prioritize installation of Microsoft’s official security updates.

These precautions may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

Critical – Prioritize Security Patch Deployment

CVE-2026-97755 should be prioritized for remediation because it carries a Critical severity rating and a CVSS score of 8.8.

The vulnerability allows potential remote code execution, requires no existing attacker privileges, and has low attack complexity.

Although Microsoft reports that exploitation is less likely and no active exploitation has been identified, the potential consequences remain significant.

Organizations should prioritize patch deployment across affected Microsoft Office environments, particularly systems frequently used to open documents from external sources.

Microsoft has released official fixes, including:

• KB5002927 – Microsoft SharePoint Server Subscription Edition.
• KB5002928 – Office Online Server.
• Official Microsoft Office updates for affected desktop and Mac editions.

Organizations should validate update applicability, deploy the appropriate security fixes, and confirm successful installation.

Delaying this patch leaves affected systems exposed to a vulnerability that could turn an ordinary Office document into a serious security incident.