CVE-2026-97759 – Microsoft Office Excel Remote Code Execution Vulnerability

CVE-2026-97759 is a Critical Remote Code Execution (RCE) vulnerability affecting Microsoft Office Excel. The vulnerability is caused by a Use-After-Free (CWE-416) memory management flaw that could allow an unauthorized attacker to execute malicious code on a vulnerable system. An attacker can exploit this weakness by creating a malicious Office file and convincing a user to open it. Successful exploitation could compromise sensitive business information, allow unauthorized changes to data, and disrupt system availability. Although exploitation is considered less likely and no active exploitation has been reported, the vulnerability presents a significant security risk because exploitation requires no prior attacker privileges.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a serious security threat to organizations using affected versions of Microsoft Office Excel.

An attacker could exploit the vulnerability through a specially crafted Office document delivered to a targeted user.

The attack requires user interaction, meaning the victim must open the malicious document for exploitation to occur.

Key security concerns include:

• Remote Code Execution: Attackers could execute malicious code on vulnerable systems.
• Sensitive Data Exposure: Successful exploitation could compromise confidential business information.
• Data Integrity Risks: Attackers could potentially modify or destroy important business data.
• Operational Disruption: Compromised systems could experience service interruptions or loss of availability.
• Low Attack Complexity: The vulnerability has low attack complexity and requires no attacker privileges, making it a significant concern.

The vulnerability has a network-based attack vector, increasing its potential exposure.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication:

• Active Exploitation: No known exploitation reported.
• Public Disclosure: No.
• Exploit Code Maturity: Unproven.
• Zero-Day Exploitation: No known zero-day exploitation reported.
• Proof-of-Concept (PoC): The existence of publicly available PoC exploit code is not confirmed.

Although there are no reports of active exploitation, the vulnerability could become an attractive target because it allows remote code execution with low attack complexity.

Attackers would need to convince a user to open a malicious Office document to trigger the vulnerability.

The Microsoft Office Preview Pane is not an attack vector for this vulnerability.

Technical Summary

CVE-2026-97759 is a Use-After-Free (CWE-416) vulnerability affecting Microsoft Office Excel.

A Use-After-Free vulnerability occurs when an application attempts to access memory that has already been released.

Improper handling of released memory can cause unexpected application behavior, memory corruption, or potentially allow attackers to execute malicious code.

In this case, the vulnerability could allow an unauthorized attacker to execute code when a victim opens a specially crafted Office document.

The attack follows this general sequence:

1. An attacker creates a malicious Office document designed to trigger the memory management vulnerability.

2. The attacker delivers the malicious document to a targeted user.

3. The attacker convinces the user to open the document in an affected Microsoft Office application.

4. Processing the malicious document could trigger the Use-After-Free condition.

5. Successful exploitation could allow the attacker to execute malicious code on the affected system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high confidentiality, integrity, and availability impact ratings indicate that successful exploitation could significantly compromise the security of affected systems.

Microsoft has confirmed the vulnerability and identified an official fix.

Exploitability

The vulnerability affects the following Microsoft Office products:

• Microsoft 365 Apps for Enterprise for 32-bit Systems
• Microsoft 365 Apps for Enterprise for 64-bit Systems
• Microsoft Office LTSC 2024 for 32-bit editions
• Microsoft Office LTSC 2024 for 64-bit editions

Exploitation Requirements:

An attacker must create a malicious Office file and convince a user to open it.

No attacker privileges are required, but user interaction is necessary.

The vulnerability has low attack complexity and is classified as Exploitation Less Likely.

The Preview Pane cannot be used to exploit this vulnerability.

Specific affected build numbers and fixed build numbers are not confirmed.

Business Impact

CVE-2026-97759 poses a significant business risk because Microsoft Office applications are commonly used to process business documents.

A successful attack could compromise employee workstations and expose sensitive organizational information.

Potential business consequences include:

• Data Breaches: Attackers could gain access to confidential business documents, financial information, or sensitive customer records.
• Unauthorized Code Execution: Malicious code could execute on compromised systems, potentially enabling additional malicious activity.
• Business Disruption: Compromised systems could become unavailable, affecting employee productivity and business operations.
• Data Manipulation: Attackers could potentially modify or destroy critical business information.
• Financial Losses: Incident investigation, system recovery, and operational downtime could generate significant costs.
• Reputational Damage: Security incidents involving confidential information could damage customer confidence and business relationships.

“A trusted spreadsheet can become an unexpected security threat when a single malicious document opens the door to unauthorized code execution.”

Organizations that frequently exchange Office documents with external parties may face additional exposure to malicious document attacks.

The combination of remote code execution, low attack complexity, and no required attacker privileges makes this vulnerability particularly concerning.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

If immediate patch deployment is not possible, organizations can consider the following temporary risk-reduction measures:

• Avoid opening Office documents from unknown or untrusted sources.
• Educate employees about malicious document attacks.
• Use email security controls to detect and block suspicious attachments.
• Monitor endpoints for unusual Office application behavior.
• Restrict unnecessary access to sensitive business resources.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

Critical Severity – High Deployment Priority

CVE-2026-97759 should be prioritized for patch deployment because it could allow attackers to execute malicious code through a specially crafted Office document.

Although Microsoft currently assesses exploitation as less likely, the vulnerability has several characteristics that increase its security significance:

• Critical Severity: The vulnerability carries a CVSS base score of 8.8.
• Remote Code Execution: Successful exploitation could allow unauthorized execution of malicious code.
• No Privileges Required: Attackers do not need existing access privileges.
• Low Attack Complexity: Exploitation does not require complex attack conditions.
• High Business Impact: Successful attacks could compromise confidentiality, integrity, and availability.

“Waiting for an attack to become widespread can turn a manageable security weakness into a costly business incident.”

Organizations should prioritize deploying the official Microsoft security updates across affected Microsoft 365 Apps for Enterprise and Office LTSC 2024 installations.

Systems that regularly handle externally sourced Office documents should receive particular attention during patch planning.

Since no official workaround is identified, applying the security update is the recommended remediation approach.