CVE-2026-97756 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has identified a Critical Remote Code Execution (RCE) vulnerability in Microsoft Office Excel that could allow an unauthorized attacker to execute malicious code on an affected system. The vulnerability, tracked as CVE-2026-97756, is caused by a heap-based buffer overflow. An attacker could exploit this weakness by convincing a user to open a specially crafted Office file. Successful exploitation could compromise sensitive information, allow unauthorized system modifications, or disrupt business operations. Although exploitation is considered less likely and no active exploitation has been reported, the vulnerability presents a significant security risk because attackers do not require existing system privileges.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a serious security threat because attackers could execute malicious code through a specially crafted Microsoft Office file.

An attacker could distribute a malicious Excel document through phishing emails, file-sharing platforms, or other communication channels and convince an employee to open it.

Successful exploitation could result in:

• Unauthorized Code Execution: Attackers could execute malicious commands on compromised systems.
• Sensitive Data Exposure: Confidential business information, financial records, and internal documents could be exposed.
• System Compromise: Attackers could modify files, interfere with applications, or perform unauthorized activities.
• Business Disruption: Compromised systems could become unavailable, affecting employee productivity and critical operations.

The vulnerability has low attack complexity and requires no prior privileges, making it particularly concerning when combined with phishing or social engineering attacks.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The vulnerability is not publicly disclosed, and there are no reported cases of active exploitation.

The exploit code maturity is classified as Unproven, meaning the existence of a working public exploit or proof-of-concept (PoC) has not been confirmed.

There is also no confirmed evidence of this vulnerability being exploited as a zero-day attack.

However, the vulnerability could potentially be exploited through a malicious Office document that triggers the underlying memory corruption issue.

Technical Summary

CVE-2026-97756 is a heap-based buffer overflow vulnerability (CWE-122) affecting Microsoft Office Excel.

A heap-based buffer overflow occurs when an application writes more data into a dynamically allocated memory region than that region can safely accommodate.

This memory corruption can affect adjacent memory locations and potentially allow attackers to influence application behavior or execute malicious code.

In this case, an attacker could exploit the vulnerability by creating a specially crafted Microsoft Office file designed to trigger the buffer overflow when opened in an affected application.

The attack follows these steps:

1. An attacker prepares a malicious Microsoft Office document containing specially crafted content.

2. The attacker delivers the document to a targeted user, potentially through email or another file-sharing method.

3. The attacker convinces the user to open the malicious document.

4. Opening the document could trigger the heap-based buffer overflow.

5. Successful exploitation could allow the attacker to execute unauthorized code on the affected system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Importantly, the Microsoft Office Preview Pane is not an attack vector for this vulnerability.

The attacker must convince the victim to open the malicious Office file.

Successful exploitation could compromise the confidentiality, integrity, and availability of the affected system.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit)
• Microsoft Office 365 for Mac
• Microsoft Office LTSC 2021 (32-bit and 64-bit)
• Microsoft Office LTSC 2024 (32-bit and 64-bit)
• Microsoft Office LTSC for Mac 2021
• Microsoft Office LTSC for Mac 2024
• Office Online Server

The vulnerability is rated Critical for the affected Mac editions and Important for the listed Windows editions and Office Online Server.

Specific affected build numbers are not identified.

An attacker could exploit the vulnerability by convincing a user to open a malicious Office document.

No existing privileges are required, but user interaction is necessary.

The likelihood of exploitation is currently assessed as Exploitation Less Likely.

Business Impact

This vulnerability could have significant consequences for organizations that rely on Microsoft Office applications for daily operations.

Excel documents are widely used for financial reporting, business analysis, operational planning, and handling sensitive corporate information.

A malicious document exploiting this vulnerability could turn a routine business activity into a serious security incident.

Potential business consequences include:

• Data Breaches: Attackers could gain unauthorized access to confidential business documents, financial information, or sensitive corporate data.
• Financial Losses: Security incidents could result in investigation costs, recovery expenses, and operational downtime.
• Operational Disruption: Successful exploitation could interfere with employee productivity and business-critical applications.
• Regulatory and Compliance Risks: Exposure of sensitive information could create compliance obligations and potential regulatory consequences.
• Reputational Damage: A successful cyberattack could undermine customer confidence and damage business relationships.

Because exploitation requires opening a malicious Office file, phishing and social engineering could play an important role in potential attacks.

A trusted-looking spreadsheet could become the entry point for a major security incident.

Organizations with large numbers of Microsoft Office users may face increased exposure because employees regularly exchange documents with internal and external contacts.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

If immediate patch deployment is not possible, organizations should consider these precautionary measures:

• Avoid opening unexpected or suspicious Office attachments.
• Educate employees about malicious documents and phishing attempts.
• Use email security controls to detect potentially harmful attachments.
• Restrict access to untrusted Office documents where operationally practical.
• Monitor endpoints for suspicious activity associated with Office applications.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Applying the official Microsoft security update remains the recommended remediation.

For Office Online Server, the associated security update is KB5002928.

Urgency

Priority: HIGH – Deploy Security Updates Promptly

CVE-2026-97756 carries a Critical maximum severity rating and a CVSS score of 8.8, indicating a significant security risk.

Although Microsoft currently assesses exploitation as less likely, the vulnerability could enable remote code execution with low attack complexity and without requiring attacker privileges.

The requirement for user interaction reduces the ease of exploitation, but malicious Office documents remain a potential attack method.

Organizations should prioritize patch deployment, particularly for affected Mac editions rated Critical and systems frequently used to open external Office documents.

Recommended deployment priorities include:

• Critical Priority: Microsoft Office 365 for Mac and Microsoft Office LTSC for Mac 2021 and 2024.
• High Priority: Affected Microsoft 365 Apps for Enterprise and Office LTSC installations.
• High Priority: Office Online Server environments requiring security update KB5002928.

An official fix is identified, but fixed build numbers are not specified. Restart requirements are unknown for the listed Windows products and Office Online Server, while Mac products indicate that a restart may be required.

Even without confirmed active exploitation, delaying security updates leaves organizations exposed to a vulnerability capable of executing malicious code through an Office document.

Timely patching, combined with employee awareness and effective email security controls, can help reduce the likelihood of a successful attack.

—