CVE-2026-97767 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft released a security update on October 13, 2026, addressing CVE-2026-97767, a Critical remote code execution vulnerability affecting Microsoft Office Excel. The vulnerability involves a double-free memory management weakness and a NULL pointer dereference issue that could allow an unauthenticated attacker to execute malicious code when a user opens a specially crafted Office file. With low attack complexity and no authentication required, this vulnerability presents a significant risk to organizations that regularly exchange spreadsheets through email, collaboration platforms, and shared storage. Successful exploitation could expose confidential information, disrupt business operations, and provide attackers with an opportunity to compromise additional corporate systems.

CVSS Score: 8.8

SEVERITY: CVSS v3.1 severity label does not exist in the supplied Metrics.

Threat

The primary threat is remote code execution through a malicious Office file opened in a vulnerable Microsoft Excel application.

An attacker could create a specially crafted Office file and distribute it through email, file-sharing platforms, or other business communication channels. If an employee opens the malicious file, the vulnerability could be triggered, potentially allowing unauthorized code execution on the affected system.

Attackers do not need valid credentials or existing access to the target computer. However, successful exploitation requires the victim to open the malicious document.

This creates a significant risk for organizations where employees routinely receive invoices, financial reports, payroll spreadsheets, and operational documents from external sources.

Exploits

• Publicly Disclosed: No
• Actively Exploited: No
• Public Proof-of-Concept (PoC): Not confirmed; exploit code maturity is listed as Unproven.
• Exploitability Assessment: Exploitation Less Likely

The Preview Pane is not an attack vector for this vulnerability. An attacker must convince a user to open a malicious Office file.

Although exploitation is considered less likely, the low attack complexity and absence of authentication requirements make malicious document delivery an important security concern.

Technical Summary

CVE-2026-97767 is a remote code execution vulnerability involving two memory safety weaknesses in Microsoft Office Excel: a double-free condition (CWE-415) and a NULL pointer dereference (CWE-476).

A double-free vulnerability occurs when software attempts to release the same memory allocation more than once. This can corrupt memory management structures and potentially allow an attacker to manipulate application behavior.

A NULL pointer dereference occurs when software attempts to access memory through a pointer that does not reference a valid object. This commonly causes application crashes and may contribute to broader memory safety problems.

In this case, an attacker could create a specially crafted Office file designed to trigger the vulnerable memory handling behavior when Excel processes the document.

If exploitation succeeds, the attacker could potentially execute unauthorized code on the affected system. The exact relationship between the two weaknesses, the internal exploitation mechanism, and the resulting execution privileges are not specified in the vulnerability details.

The CVSS v3.1 metrics identify several important attack characteristics:

• Attack Vector: Network, allowing malicious documents to be delivered remotely.
• Attack Complexity: Low, indicating exploitation does not require unusually complex conditions.
• Privileges Required: None, meaning the attacker does not need authenticated access.
• User Interaction: Required, because the victim must open the malicious Office file.
• Scope: Unchanged, meaning the impact remains within the affected security authority.
• Confidentiality: High, indicating potentially serious exposure of sensitive information.
• Integrity: High, indicating the possibility of unauthorized changes to files or system resources.
• Availability: High, indicating potentially serious disruption to affected systems.

Successful exploitation could allow attackers to execute malicious programs, access confidential information, modify important business documents, or interrupt normal system operations.

Exploitability

Affected Microsoft products include:

• Microsoft 365 Apps for Enterprise: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2021: 32-bit and 64-bit editions.
• Microsoft Office LTSC for Mac: 2021 and 2024.
• Microsoft Office 365 for Mac.
• Office Online Server.

An unauthenticated attacker could attempt exploitation by sending a specially crafted Office file and convincing a user to open it. The Preview Pane is not an attack vector.

The security updates for Microsoft Office LTSC for Mac 2021 and 2024 were not immediately available at the time of publication. Microsoft indicated that the updates would be released later.

Business Impact

CVE-2026-97767 represents a significant security risk for organizations that rely on Microsoft Excel for financial reporting, budgeting, data analysis, and everyday business operations.

Excel files are routinely exchanged between employees, customers, suppliers, and external business partners. Attackers could disguise malicious Office files as legitimate invoices, financial statements, payment requests, or operational reports to convince employees to open them.

Because exploitation requires no attacker authentication and has low attack complexity, a successful phishing attempt could potentially lead to unauthorized code execution and further compromise.

Potential business consequences include:

• Unauthorized System Compromise: Attackers could execute malicious code on affected computers.
• Sensitive Data Exposure: Confidential financial records, customer information, and internal business documents could potentially be accessed or stolen.
• Malware and Ransomware Deployment: Compromised systems could be used to install additional malicious software.
• Financial Data Manipulation: Attackers could modify important spreadsheets, financial records, or operational reports.
• Operational Disruption: Successful exploitation could interrupt employee productivity and essential business processes.
• Lateral Movement: Attackers could potentially use compromised systems to target additional resources within the corporate network.
• Financial and Reputational Damage: Security incidents could result in recovery expenses, business downtime, and loss of customer confidence.

“When spreadsheets carry the financial and operational information that keeps a business running, one malicious document could put far more than a single workstation at risk.”

Workaround

Until the official Microsoft security updates can be deployed, organizations should consider the following risk-reduction measures:

• Avoid opening unsolicited or suspicious Excel and Office files.
• Block or quarantine potentially malicious Office attachments using email security controls.
• Use Protected View and other available Microsoft Office security protections.
• Apply least-privilege controls and restrict access to untrusted documents.
• Monitor security update availability for Microsoft Office LTSC for Mac 2021 and 2024.
• Deploy the appropriate Microsoft Office security updates promptly.

These measures may reduce exposure but are not confirmed Microsoft workarounds for the underlying vulnerability.

Urgency

CVE-2026-97767 carries a Critical maximum severity rating and a CVSS v3.1 base score of 8.8, reflecting the potentially serious consequences of successful remote code execution.

The vulnerability is particularly concerning because attackers do not need authentication, attack complexity is low, and malicious Office files can be delivered through familiar business communication channels.

Although Microsoft considers exploitation less likely and reports no known active exploitation, successful exploitation could compromise sensitive business information, interrupt operations, and potentially create opportunities for further attacks.

Organizations should prioritize identifying affected Microsoft Office installations, deploying available October 2026 security updates, and strengthening protection against malicious Office attachments.

Additional attention should be given to Microsoft Office LTSC for Mac 2021 and 2024 because security updates were not immediately available at the time of publication.

“When opening a single spreadsheet could allow malicious code execution, delaying security updates can leave critical business information and systems unnecessarily exposed.”