CVE-2026-97758 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has addressed a Critical Remote Code Execution (RCE) vulnerability in Microsoft Office Excel that could allow an unauthorized attacker to execute malicious code on an affected system. The vulnerability, caused by a heap-based buffer overflow, can be exploited when a user opens a specially crafted Office file. An attacker does not need existing privileges, making this vulnerability particularly concerning. Successful exploitation could compromise sensitive information, allow unauthorized system changes, or disrupt business operations. Although exploitation is considered less likely and no active exploitation has been reported, the potential impact makes this an important security update.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security threat because it allows remote code execution through a malicious Office file.

An attacker could distribute a specially crafted Excel file through email or other communication channels and convince an employee to open it.

Once the malicious file is opened, the vulnerability could allow the attacker to execute code on the affected system.

The main security concerns include:

• Unauthorized Code Execution: Attackers could execute malicious code on vulnerable systems.
• Sensitive Data Exposure: Confidential business information could be accessed or stolen.
• System Compromise: Attackers could potentially install malicious software or modify system files.
• Business Disruption: Successful exploitation could affect system availability and interrupt business operations.

The vulnerability has low attack complexity and requires no prior privileges, increasing the potential risk if users open malicious files.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The vulnerability is not publicly disclosed and has not been reported as actively exploited.

The exploit code maturity is classified as Unproven, meaning there is no confirmed evidence of a working public exploit.

No confirmed zero-day exploitation or publicly available proof-of-concept (PoC) exploit code is identified.

However, attackers could potentially develop exploitation techniques targeting the underlying heap-based buffer overflow.

Technical Summary

CVE-2026-97758 is a heap-based buffer overflow vulnerability (CWE-122) affecting Microsoft Office Excel.

A heap-based buffer overflow occurs when an application writes more data into a memory buffer than the allocated space can safely accommodate.

This can corrupt adjacent memory and potentially allow an attacker to influence application behavior or execute malicious code.

In this vulnerability, an attacker could create a specially crafted Office file designed to trigger the memory corruption condition.

The attack follows a relatively straightforward sequence:

1. An attacker prepares a malicious Office file containing specially crafted content.

2. The attacker delivers the file to a targeted user.

3. The attacker convinces the user to open the file using a vulnerable Office application.

4. Processing the malicious file could trigger the heap-based buffer overflow.

5. Successful exploitation could allow unauthorized code execution on the affected system.

The vulnerability has a CVSS v3.1 base score of 8.8, with high potential impact on confidentiality, integrity, and availability.

The attack vector is classified as Network, with Low attack complexity and no privileges required.

However, user interaction is required because the victim must open the malicious Office file.

Microsoft has also confirmed that the Preview Pane is not an attack vector, meaning simply previewing the file through that mechanism does not trigger this vulnerability.

Exploitability

The vulnerability affects multiple Microsoft Office products across Windows and macOS environments.

Affected products include:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit)
• Microsoft Office 365 for Mac
• Microsoft Office LTSC 2021 (32-bit and 64-bit)
• Microsoft Office LTSC 2024 (32-bit and 64-bit)
• Microsoft Office LTSC for Mac 2021
• Microsoft Office LTSC for Mac 2024
• Office Online Server

The exact affected build numbers are not specified.

An attacker must convince a user to open a specially crafted Office file to exploit the vulnerability.

No prior privileges are required, and the attack complexity is Low.

Although exploitation is considered less likely, successful exploitation could result in remote code execution.

Business Impact

This vulnerability could pose a serious risk to organizations that rely heavily on Microsoft Excel and other Office applications for everyday business activities.

Excel files are frequently exchanged through emails, shared folders, and business collaboration platforms, creating opportunities for attackers to distribute malicious documents.

A trusted-looking spreadsheet could become an entry point for a major security incident.

Successful exploitation could result in:

• Data Breaches: Attackers could gain access to confidential business records, financial information, or customer data.
• Malware Infections: Compromised systems could be used to execute malicious software.
• Operational Disruption: Critical business applications or employee workstations could become unavailable.
• Financial Losses: Incident response, recovery activities, and business downtime could create additional costs.
• Reputational Damage: Unauthorized access to sensitive information could undermine customer and stakeholder confidence.

Organizations with large Microsoft Office deployments may face increased exposure because employees regularly open Office documents from internal and external sources.

The biggest danger is that an ordinary business document could become the starting point for a much larger cyberattack.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

If immediate patch deployment is not possible, organizations should consider the following precautionary measures:

• Avoid opening unexpected or suspicious Office attachments.
• Verify the sender before opening externally received Excel files.
• Use email security controls to detect and block potentially malicious attachments.
• Restrict access to untrusted Office documents where operationally possible.
• Prioritize updating affected Microsoft Office installations.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

High Priority – Deploy Security Updates Promptly

CVE-2026-97758 carries a Critical maximum severity rating and a CVSS score of 8.8, making it an important vulnerability to address.

Although there is no confirmed active exploitation or public disclosure, the vulnerability presents significant potential consequences because it could allow remote code execution.

The combination of low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability makes this vulnerability particularly concerning.

Organizations should prioritize patch deployment across affected Microsoft Office environments, especially systems that frequently process documents received from external parties.

Microsoft Office 365 for Mac and Microsoft Office LTSC for Mac 2021 and 2024 are rated Critical, making these deployments particularly important to address.

Windows-based Office products and Office Online Server are rated Important but remain exposed to the same underlying vulnerability.

An official fix is identified, although exact fixed build numbers are not specified.

Patch deployment should be prioritized before attackers have an opportunity to turn a malicious spreadsheet into a successful system compromise.