CVE-2026-97761 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has released a security update on October 13, 2026, addressing CVE-2026-97761, a Critical remote code execution vulnerability affecting Microsoft Office Excel. The vulnerability is caused by a stack-based buffer overflow that could allow an unauthenticated attacker to execute malicious code when a user opens a specially crafted Office file. With low attack complexity and no attacker privileges required, the vulnerability poses a significant risk to organizations that routinely exchange spreadsheets through email, shared drives, and collaboration platforms. Successful exploitation could compromise sensitive business information, disrupt operations, and provide attackers with an initial foothold in corporate networks.

CVSS Score: 8.8

SEVERITY: CVSS v3.1 severity label not available in the supplied Metrics.

Threat

The primary threat is remote code execution through malicious Office files opened in vulnerable Microsoft Excel applications.

An attacker could create a specially crafted Office file and distribute it through email, file-sharing platforms, or other communication channels. If a user opens the file, the vulnerability could be triggered, potentially allowing malicious code to execute on the affected system.

The attacker does not need valid credentials or existing access to the target computer. However, successful exploitation requires the victim to open the malicious file.

This makes the vulnerability particularly concerning for organizations where employees regularly exchange financial statements, invoices, operational reports, and spreadsheets with external partners.

Exploits

• Publicly Disclosed: No
• Actively Exploited: No
• Public Proof-of-Concept (PoC): Not confirmed; exploit code maturity is listed as Unproven.
• Exploitability Assessment: Exploitation Less Likely

The Preview Pane is not an attack vector for this vulnerability. An attacker must convince a user to open a malicious Office file.

Although exploitation is assessed as less likely, the low attack complexity and lack of authentication requirements make the vulnerability a potential threat through phishing and malicious document delivery.

Technical Summary

CVE-2026-97761 is a stack-based buffer overflow vulnerability, classified as CWE-121, affecting Microsoft Office Excel.

A stack-based buffer overflow occurs when software writes more data into a memory buffer on the program’s stack than the buffer can safely hold. This can overwrite nearby memory, potentially corrupting application data, disrupting normal execution, or allowing an attacker to interfere with program control flow.

In this case, an attacker could create a specially crafted Office file designed to trigger the vulnerability when processed by Microsoft Excel.

If a user opens the malicious file and exploitation succeeds, the attacker could execute unauthorized code on the affected system. The exact exploitation mechanism and execution privileges are not specified in the available vulnerability information.

The CVSS v3.1 metrics identify several important characteristics:

• Attack Vector: Network, allowing malicious Office files to be delivered remotely.
• Attack Complexity: Low, indicating that exploitation does not require unusually complex conditions.
• Privileges Required: None, meaning attackers do not need authenticated access.
• User Interaction: Required, because a user must open the malicious Office file.
• Scope: Unchanged, meaning the impact remains within the affected security authority.
• Confidentiality: High, indicating the potential exposure of sensitive information.
• Integrity: High, indicating the possibility of unauthorized changes to data or system resources.
• Availability: High, indicating potentially serious disruption to affected systems.

Successful exploitation could allow malicious programs to run, confidential business information to be accessed, files to be modified, or essential applications to be disrupted.

Exploitability

Affected Microsoft products include:

• Microsoft 365 Apps for Enterprise: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: 32-bit and 64-bit editions.
• Microsoft Office LTSC for Mac: 2021 and 2024.
• Microsoft Office 365 for Mac.

An unauthenticated attacker could attempt exploitation by sending a malicious Office file and convincing a user to open it. The Preview Pane cannot trigger this vulnerability.

The security updates for Microsoft Office LTSC for Mac 2021 and 2024 were not immediately available at the time of publication.

Business Impact

CVE-2026-97761 presents a significant security risk for organizations that rely on Microsoft Excel for financial reporting, data analysis, budgeting, and everyday business operations.

Excel spreadsheets are commonly exchanged between employees, customers, suppliers, and business partners. Attackers could disguise malicious Office files as legitimate invoices, payroll reports, financial statements, or other business documents to convince employees to open them.

Because the attack requires no authentication and has low attack complexity, a successful phishing attempt could lead to unauthorized code execution and potentially broader compromise.

Potential business consequences include:

• Unauthorized System Compromise: Attackers could execute malicious code on affected computers.
• Sensitive Data Exposure: Confidential financial records, customer information, and internal business documents could potentially be stolen.
• Malware and Ransomware Deployment: Compromised systems could be used to install additional malicious software.
• Financial Data Manipulation: Attackers could modify important spreadsheets, business reports, or other sensitive information.
• Operational Disruption: Successful exploitation could interrupt employee productivity and essential business processes.
• Lateral Movement: Compromised workstations could potentially provide attackers with opportunities to target additional corporate systems.
• Financial and Reputational Damage: Security incidents could result in recovery costs, downtime, and loss of customer confidence.

“A spreadsheet may contain only numbers and formulas, but a malicious one could give attackers access to the information and systems that keep a business running.”

Workaround

Until the official Microsoft security updates can be deployed, organizations should consider the following risk-reduction measures:

• Avoid opening unsolicited or suspicious Excel and Office files.
• Block or quarantine potentially malicious Office attachments using email security controls.
• Use Protected View and other Office security protections where available.
• Restrict access to untrusted files and apply least-privilege controls.
• Monitor security update availability for Microsoft Office LTSC for Mac 2021 and 2024.
• Deploy the appropriate Microsoft Office security updates promptly.

These measures may reduce exposure but are not confirmed Microsoft workarounds for the underlying vulnerability.

Urgency

CVE-2026-97761 carries a Critical maximum severity rating and a CVSS v3.1 base score of 8.8, reflecting the potentially serious consequences of successful remote code execution.

The vulnerability is particularly concerning because attackers do not need authentication, attack complexity is low, and malicious Office files can be distributed through familiar business communication channels.

Although Microsoft considers exploitation less likely and reports no known active exploitation, successful exploitation could compromise confidential business information, interrupt critical operations, and create opportunities for additional attacks.

Organizations should prioritize identifying affected Microsoft Office installations, deploying available October 2026 security updates, and strengthening defenses against malicious Office attachments.

Special attention should be given to Microsoft Office LTSC for Mac 2021 and 2024 because security updates were not immediately available at the time of publication.

“When a single malicious spreadsheet can potentially compromise a workstation, timely patching is an important defense against data theft, malware, and costly business disruption.”