CVE-2026-97778 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has addressed a critical remote code execution (RCE) vulnerability in Microsoft Office Excel that could allow an unauthorized attacker to execute malicious code on an affected system. The vulnerability, identified as CVE-2026-97778, is caused by an integer overflow or wraparound weakness in Excel. An attacker could exploit this vulnerability by creating a malicious Office file and convincing a user to open it. Successful exploitation could compromise sensitive information, allow unauthorized system modifications, or disrupt business operations. Although Microsoft considers exploitation less likely, the vulnerability carries a high security risk because exploitation requires no prior privileges and has low attack complexity.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security threat because attackers could use specially crafted Office documents to execute malicious code on vulnerable systems.

The attack can be delivered over a network, potentially through phishing emails or other document-sharing methods. However, successful exploitation requires the targeted user to open the malicious Office file.

The vulnerability has several concerning characteristics:

• No privileges required: Attackers do not need an existing account or elevated permissions to attempt exploitation.
• Low attack complexity: Exploitation does not require complex conditions.
• User interaction required: The victim must open a malicious Office document.
• High security impact: Successful exploitation could significantly affect the confidentiality, integrity, and availability of affected systems.

The biggest concern is that a routine business activity—opening an Excel document—could become an entry point for a serious security compromise.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication:

• Publicly Disclosed: No
• Exploited in the Wild: No
• Exploit Code Maturity: Unproven

There is no confirmed evidence of active exploitation.

The existence of publicly available proof-of-concept (PoC) exploit code cannot be confirmed.

Although exploitation has not been reported, the vulnerability’s critical severity and potential for remote code execution make it an important security concern.

Technical Summary

CVE-2026-97778 is an Integer Overflow or Wraparound vulnerability (CWE-190) affecting Microsoft Office Excel.

An integer overflow occurs when a mathematical calculation produces a value outside the range that a program can safely represent. Instead of handling the value correctly, the application may produce an unexpected result.

In this case, the integer overflow or wraparound weakness in Excel could allow an unauthorized attacker to execute malicious code.

The attack requires the following conditions:

1. An attacker prepares a specially crafted malicious Office document.

2. The attacker delivers the document to a targeted user.

3. The attacker convinces the user to open the document.

4. Opening the document could trigger the vulnerability and potentially allow malicious code execution.

The vulnerability has a Network Attack Vector (AV:N) and Low Attack Complexity (AC:L), meaning an attacker can attempt exploitation remotely without requiring complex attack conditions.

Importantly, the attacker does not require any existing privileges, making the vulnerability particularly concerning in environments where employees regularly exchange Office documents.

However, user interaction is necessary. The victim must open the malicious document for exploitation to occur.

Microsoft has also confirmed that the Preview Pane is not an attack vector for this vulnerability.

Successful exploitation could result in:

• Unauthorized execution of malicious code.
• Exposure of confidential business information.
• Unauthorized modification of files or system data.
• Disruption of affected applications or systems.
• Potential compromise of business operations.

The vulnerability carries a High impact rating for Confidentiality, Integrity, and Availability, highlighting the seriousness of a successful attack.

Exploitability

The vulnerability affects several Microsoft Office products across Windows and macOS environments.

Affected Microsoft Products:

• Microsoft 365 Apps for Enterprise – 32-bit and 64-bit systems.
• Microsoft Office 365 for Mac.
• Microsoft Office LTSC 2021 – 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024 – 32-bit and 64-bit editions.
• Microsoft Office LTSC for Mac 2021.
• Microsoft Office LTSC for Mac 2024.
• Office Online Server.

The specific vulnerable build numbers and fixed build numbers are not identified.

For Office Online Server, the associated security update is KB5002928, which supersedes KB5002910.

Attackers could attempt exploitation by distributing specially crafted malicious Office files and persuading users to open them.

Exploitation requires user interaction but does not require prior privileges.

Microsoft currently assesses exploitation as less likely.

Business Impact

Microsoft Excel is widely used for financial reporting, business analysis, operational planning, and processing sensitive organizational information.

A vulnerability that allows malicious code execution through Office documents could create significant risks for organizations.

A single malicious spreadsheet could put sensitive business information, employee systems, and daily operations at risk.

Potential business consequences include:

• Sensitive Data Exposure: Attackers could potentially access confidential documents, financial information, customer records, or internal business data.
• System Compromise: Successful exploitation could allow unauthorized code execution on affected systems, potentially leading to further malicious activity.
• Operational Disruption: Compromised systems could interrupt employee productivity, business processes, and access to important documents.
• Data Integrity Risks: Attackers could potentially modify or damage business information, affecting reporting accuracy and operational decisions.
• Financial and Reputational Damage: Security incidents involving sensitive information or operational disruption could lead to investigation costs, recovery expenses, and loss of customer confidence.

Organizations that regularly receive spreadsheets from external parties may face increased exposure to malicious document-based attacks.

The real danger is not just one compromised spreadsheet—it is the potential damage that could follow when malicious code executes inside a business environment.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

If immediate patch deployment is not possible, organizations can consider these temporary risk-reduction measures:

• Advise employees not to open unexpected or suspicious Office attachments.
• Restrict Office documents from untrusted sources where operationally feasible.
• Strengthen email security controls to identify potentially malicious attachments.
• Monitor endpoints for suspicious activity involving Microsoft Office applications.
• Prioritize patch deployment on systems that frequently handle externally received documents.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

Critical Severity – High Priority Patch Deployment Recommended

CVE-2026-97778 should be prioritized for deployment because it could allow unauthorized remote code execution through a malicious Office document.

The vulnerability has a CVSS score of 8.8, requires no prior privileges, and has low attack complexity.

Although Microsoft reports no known active exploitation and assesses exploitation as less likely, the potential consequences of successful exploitation remain significant.

Organizations should prioritize updating affected Microsoft Office installations, particularly systems used by employees who frequently receive external documents.

For Office Online Server environments, administrators should evaluate deployment of KB5002928.

Microsoft has identified an official fix, making patch deployment the preferred remediation approach.

The absence of known attacks does not remove the risk. Applying the security update now can help prevent a malicious document from becoming a serious business security incident.