CVE-2026-97765 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has identified a Critical Remote Code Execution (RCE) vulnerability in Microsoft Office Excel that could allow an unauthorized attacker to execute malicious code on an affected system. The vulnerability, caused by a heap-based buffer overflow, can be exploited when an attacker convinces a user to open a specially crafted Office file. Successful exploitation could compromise sensitive information, allow unauthorized changes to files, and disrupt business operations. Although Microsoft considers exploitation less likely, the vulnerability has a CVSS score of 8.8, making it a significant security concern. An official security fix is available.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability creates a serious security risk because attackers could execute malicious code through a specially crafted Microsoft Office file.

An attacker does not need existing access or special privileges to target a vulnerable system. However, successful exploitation requires the victim to open a malicious Office document.

The attack has low complexity, meaning attackers may not need sophisticated techniques once they have prepared a malicious file.

Successful exploitation could result in:

• Unauthorized Code Execution: Attackers could execute malicious instructions on vulnerable systems.
• Sensitive Data Exposure: Confidential business documents and information could be compromised.
• System Compromise: Attackers could manipulate files or interfere with affected applications.
• Operational Disruption: Exploitation could affect system availability and interrupt business activities.
• Business Security Risks: Compromised systems could create opportunities for additional malicious activity.

The vulnerability carries a high potential impact on confidentiality, integrity, and availability.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The vulnerability has not been publicly disclosed, and there are no reported instances of active exploitation.

The maturity of exploit code is classified as Unproven. The existence of publicly available proof-of-concept (PoC) exploit code cannot be confirmed.

There is currently no indication that this vulnerability is being actively exploited as a zero-day.

However, because exploitation requires no prior privileges and has low attack complexity, organizations should not underestimate the potential threat.

Technical Summary

CVE-2026-97765 is a heap-based buffer overflow vulnerability (CWE-122) affecting Microsoft Office Excel.

A heap-based buffer overflow occurs when an application writes more data into a memory buffer than the allocated space can safely accommodate.

This can corrupt adjacent memory and potentially allow attackers to execute malicious code.

In this case, an attacker could create a specially crafted Microsoft Office file designed to trigger the vulnerability when opened in an affected application.

The attack follows these steps:

1. An attacker prepares a malicious Office document containing specially crafted content.

2. The attacker delivers the document to a target user and convinces them to open it.

3. The vulnerable application processes the malicious content, potentially triggering a heap-based buffer overflow.

4. Successful exploitation could allow the attacker to execute arbitrary code on the affected system.

The vulnerability is classified as Remote Code Execution, with a network attack vector and low attack complexity.

Importantly, the attacker does not require any existing privileges, but user interaction is necessary.

Microsoft has also confirmed that the Preview Pane is not an attack vector for this vulnerability. The malicious document must be opened for the attack to succeed.

The vulnerability has a high potential impact on all three major security areas:

• Confidentiality: Attackers could gain access to sensitive information.
• Integrity: Attackers could modify or manipulate information.
• Availability: Attackers could disrupt applications or system operations.

Microsoft has released an official fix to address this vulnerability.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit)
• Microsoft Office 365 for Mac
• Microsoft Office LTSC 2021 (32-bit and 64-bit)
• Microsoft Office LTSC 2024 (32-bit and 64-bit)
• Microsoft Office LTSC for Mac 2021
• Microsoft Office LTSC for Mac 2024
• Office Online Server

For Office Online Server, Microsoft identifies KB5002928 as the relevant security update.

Specific affected build numbers and fixed build numbers are not confirmed.

An attacker could exploit the vulnerability by convincing a user to open a specially crafted Office file.

No privileges are required, but user interaction is necessary.

Microsoft rates exploitation as less likely, and no active exploitation has been reported.

Business Impact

This vulnerability represents a significant business security concern because Microsoft Office applications are widely used to process business documents, financial spreadsheets, and sensitive organizational information.

“A trusted business document can become an attacker’s entry point. One malicious file could turn everyday office work into a serious security incident.”

If successfully exploited, the vulnerability could lead to several consequences.

1. Sensitive Business Information Exposure

Attackers could potentially gain access to confidential documents, financial information, internal reports, and other sensitive organizational data.

2. Unauthorized System Access

Successful remote code execution could allow attackers to execute malicious commands or programs on compromised systems.

3. Business Operations Disruption

Attackers could interfere with critical applications, manipulate files, or disrupt normal business activities.

4. Financial and Reputational Damage

A successful compromise could result in incident response costs, operational downtime, potential data exposure, and damage to customer confidence.

5. Increased Security Exposure

Compromised systems could potentially be used as a starting point for additional malicious activities, depending on the attacker’s access and the organization’s security controls.

Organizations relying heavily on Microsoft Office for daily operations should prioritize reducing exposure to this vulnerability.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

If immediate patch deployment is not possible, organizations can consider temporary risk-reduction measures:

• Avoid opening unexpected or suspicious Office attachments.
• Restrict Office documents received from untrusted sources.
• Educate employees about malicious document-based attacks.
• Use email security controls to identify and block suspicious attachments.
• Monitor endpoints for unusual Office application behavior.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Applying the official Microsoft security update remains the recommended remediation.

Urgency

Critical Severity – Prioritize Security Patch Deployment

CVE-2026-97765 should be prioritized for patch deployment because it combines a high CVSS score of 8.8, low attack complexity, and the potential for remote code execution.

The vulnerability is particularly concerning because attackers do not require existing privileges to attempt exploitation.

Although Microsoft currently considers exploitation less likely and has not reported active attacks, the potential consequences of successful exploitation are significant.

A malicious Office file could compromise sensitive business information, allow unauthorized code execution, and disrupt critical business operations.

Organizations should prioritize patching affected Microsoft Office installations, particularly systems frequently used to open documents received from external sources.

Recommended Action: Deploy the official Microsoft security updates promptly, following appropriate testing and organizational change-management procedures.

“The cost of patching is predictable. The damage from a successful attack may not be. Closing this security gap now can prevent a much bigger problem later.”