CVE-2026-97776 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has released a security update on October 13, 2026, addressing CVE-2026-97776, a Critical remote code execution vulnerability affecting Microsoft Office Excel. The vulnerability is caused by a heap-based buffer overflow that could allow an unauthenticated attacker to execute malicious code when a user opens a specially crafted Office file. With low attack complexity and no authentication required, the vulnerability presents a significant risk to organizations that regularly exchange spreadsheets through email, collaboration platforms, and shared storage. Successful exploitation could compromise sensitive business information, disrupt operations, and provide attackers with an initial foothold inside corporate networks.

CVSS Score: 8.8

SEVERITY: CVSS v3.1 severity label not available in the Metrics.

Threat

The primary threat is remote code execution through malicious Office files opened in vulnerable Microsoft Excel applications.

An attacker could create a specially crafted Office file and deliver it to a targeted employee through email, file-sharing platforms, or other communication channels. If the employee opens the malicious file, the vulnerability could be triggered, potentially allowing the attacker to execute unauthorized code on the affected system.

The attacker does not need valid credentials or existing access to the target system. However, exploitation requires the victim to open the malicious file.

This makes the vulnerability particularly concerning for organizations where employees routinely exchange financial reports, invoices, payroll spreadsheets, and business documents with external parties.

Exploits

• Publicly Disclosed: No
• Actively Exploited: No
• Public Proof-of-Concept (PoC): Not confirmed; exploit code maturity is listed as Unproven.
• Exploitability Assessment: Exploitation Less Likely

The Preview Pane is not an attack vector for this vulnerability. An attacker must convince a user to open a malicious Office file.

Although Microsoft assesses exploitation as less likely, the low attack complexity and lack of authentication requirements create a potential risk through phishing and malicious document delivery.

Technical Summary

CVE-2026-97776 is a heap-based buffer overflow vulnerability, classified as CWE-122, affecting Microsoft Office Excel.

A heap-based buffer overflow occurs when software writes more data into a dynamically allocated memory buffer than the buffer can safely hold. This can overwrite adjacent memory, corrupt application data, and potentially allow an attacker to interfere with normal program execution.

In this case, an attacker could create a specially crafted Office file designed to trigger the memory corruption weakness when Excel processes its contents.

If the user opens the malicious file and exploitation succeeds, the attacker could execute unauthorized code on the affected system. The precise internal exploitation mechanism and execution privileges are not specified in the available vulnerability information.

The CVSS v3.1 metrics identify several important characteristics:

• Attack Vector: Network, allowing malicious Office files to be delivered remotely.
• Attack Complexity: Low, meaning exploitation does not require unusually complex conditions.
• Privileges Required: None, meaning attackers do not need authenticated access.
• User Interaction: Required, because the victim must open the malicious Office file.
• Scope: Unchanged, meaning the impact remains within the affected security authority.
• Confidentiality: High, indicating potentially serious exposure of sensitive information.
• Integrity: High, indicating the possibility of unauthorized modification of files or system resources.
• Availability: High, indicating potentially serious disruption to affected systems.

Successful exploitation could allow attackers to run malicious programs, access confidential information, modify important business files, or interfere with normal system operations.

Exploitability

Affected Microsoft products include:

• Microsoft 365 Apps for Enterprise: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2021: 32-bit and 64-bit editions.
• Microsoft Office LTSC for Mac: 2021 and 2024.
• Microsoft Office 365 for Mac.
• Office Online Server.

An unauthenticated attacker could attempt exploitation by sending a malicious Office file and convincing a user to open it. The Preview Pane cannot trigger this vulnerability.

The security updates for Microsoft Office LTSC for Mac 2021 and 2024 were not immediately available at the time of publication. Microsoft indicated that customers would be notified when the updates become available.

Business Impact

CVE-2026-97776 represents a significant security concern for organizations that rely on Microsoft Excel for financial management, business reporting, operational planning, and daily collaboration.

Excel spreadsheets are routinely shared between employees, customers, suppliers, and business partners. Attackers could disguise malicious Office files as legitimate invoices, payment records, financial statements, or operational reports to persuade employees to open them.

Because exploitation requires no attacker authentication and has low attack complexity, a successful phishing attempt could lead to unauthorized code execution and potentially wider compromise.

Potential business consequences include:

• Unauthorized System Compromise: Attackers could execute malicious code on affected devices.
• Sensitive Data Exposure: Confidential financial records, customer information, and internal documents could potentially be accessed or stolen.
• Malware and Ransomware Deployment: Compromised systems could potentially be used to install additional malicious software.
• Financial Data Manipulation: Attackers could alter important spreadsheets, financial reports, or other business records.
• Operational Disruption: Successful exploitation could interrupt employee productivity and essential business processes.
• Lateral Movement: Compromised systems could potentially provide attackers with opportunities to target additional corporate resources.
• Financial and Reputational Damage: Security incidents could result in recovery expenses, downtime, and loss of customer confidence.

“A spreadsheet may look like an ordinary business document, but one malicious file could expose financial data, compromise employee systems, and disrupt the operations that keep a company running.”

Workaround

Until the official Microsoft security updates can be deployed, organizations should consider the following risk-reduction measures:

• Avoid opening unsolicited or suspicious Excel and Office files.
• Block or quarantine potentially malicious Office attachments using email security controls.
• Use Protected View and other available Microsoft Office security protections.
• Apply least-privilege controls and restrict access to untrusted documents.
• Monitor security update availability for Microsoft Office LTSC for Mac 2021 and 2024.
• Deploy the appropriate Microsoft Office security updates promptly.

These measures may reduce exposure but are not confirmed Microsoft workarounds for the underlying vulnerability.

Urgency

CVE-2026-97776 carries a Critical maximum severity rating and a CVSS v3.1 base score of 8.8, reflecting the potentially serious consequences of successful remote code execution.

The vulnerability is particularly concerning because attackers do not need authentication, attack complexity is low, and malicious Office documents can be distributed through common business communication channels.

Although Microsoft considers exploitation less likely and reports no known active exploitation, successful exploitation could compromise confidential business information, interrupt critical operations, and create opportunities for further attacks.

Organizations should prioritize identifying affected Microsoft Office installations, deploying available October 2026 security updates, and strengthening defenses against malicious Office attachments.

Additional attention should be given to Microsoft Office LTSC for Mac 2021 and 2024 because security updates were not immediately available at the time of publication.

“When opening a single spreadsheet could lead to malicious code execution, timely patching becomes an important defense against data theft, ransomware, and business disruption.”