CVE-2026-97780 – Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft has addressed a Critical Remote Code Execution (RCE) vulnerability in Microsoft Office Excel that could allow an unauthorized attacker to execute malicious code on an affected system. The vulnerability, identified as CVE-2026-97780, results from a heap-based buffer overflow and can be triggered when a user opens a specially crafted malicious Office file. An attacker does not need existing access privileges, making this vulnerability particularly concerning. Successful exploitation could compromise sensitive information, allow unauthorized changes to data, or disrupt business operations. Although Microsoft considers exploitation less likely and no active exploitation has been reported, the potential impact makes this an important security update.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security threat because it allows attackers to execute malicious code through a specially crafted Microsoft Office file.

An attacker could deliver a malicious document through email or another file-sharing method and convince an employee to open it.

Successful exploitation could result in:

• Unauthorized Code Execution: Attackers could execute malicious commands on an affected system.
• Sensitive Data Exposure: Confidential business documents, financial information, and other sensitive data could be compromised.
• System Compromise: Attackers could potentially install malware or modify important files.
• Business Disruption: Compromised systems could experience operational interruptions or loss of availability.

The vulnerability has low attack complexity and requires no prior privileges, although user interaction is necessary.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The vulnerability was not publicly disclosed and was not known to be actively exploited at the time of publication.

The exploit code maturity is classified as Unproven, meaning the existence of functional public exploit code or proof-of-concept (PoC) code has not been confirmed.

There is also no confirmed evidence of this vulnerability being exploited as a zero-day.

However, the vulnerability’s low attack complexity and lack of privilege requirements could make it attractive to attackers attempting to compromise systems through malicious Office documents.

Technical Summary

CVE-2026-97780 is a heap-based buffer overflow vulnerability (CWE-122) affecting Microsoft Office Excel.

A heap-based buffer overflow occurs when an application writes more information into a memory buffer than the allocated space can safely accommodate.

This condition can corrupt memory and potentially allow an attacker to execute unauthorized code.

In this case, an attacker could exploit the vulnerability by creating a specially crafted Microsoft Office file designed to trigger the memory corruption condition.

The attack requires the following sequence:

1. An attacker prepares a malicious Office document.

2. The attacker delivers the document to a targeted user.

3. The user is convinced to open the malicious file.

4. The crafted file triggers the heap-based buffer overflow.

5. Successful exploitation allows the attacker to execute malicious code on the affected system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Importantly, the Microsoft Office Preview Pane is not an attack vector for this vulnerability.

This means an attacker must convince the targeted user to open the malicious document rather than simply relying on the file being previewed.

Successful exploitation could compromise the confidentiality, integrity, and availability of information processed by the affected application.

Microsoft has released an official security fix to address this vulnerability.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit)
• Microsoft Office 365 for Mac
• Microsoft Office LTSC 2021 (32-bit and 64-bit)
• Microsoft Office LTSC 2024 (32-bit and 64-bit)
• Microsoft Office LTSC for Mac 2021
• Microsoft Office LTSC for Mac 2024
• Office Online Server

The specific affected build numbers are not confirmed.

Exploitation requires a user to open a malicious Office file. No existing attacker privileges are required.

Although exploitation is considered less likely, successful exploitation could lead to remote code execution.

Business Impact

This vulnerability represents a significant business risk because Microsoft Office applications are widely used for everyday activities, including financial reporting, document management, and business communication.

A malicious Office file disguised as a legitimate business document could expose organizations to serious security consequences.

Potential business impacts include:

• Data Breaches: Attackers could gain access to confidential financial records, employee information, and sensitive business documents.
• Malware Infections: Successful exploitation could enable malicious software to execute on compromised systems.
• Operational Disruption: Compromised endpoints could affect employee productivity and interrupt critical business processes.
• Financial Losses: Security incidents could result in investigation costs, recovery expenses, and business downtime.
• Reputational Damage: Unauthorized disclosure of sensitive information could damage customer confidence and business relationships.

Organizations that frequently exchange Excel spreadsheets with external parties may face increased exposure to malicious document-based attacks.

The biggest danger is that a routine business document could become the entry point for a costly security incident.

Workaround

Microsoft has not identified any official workaround or mitigation for this vulnerability.

If immediate patch deployment is not possible, organizations should consider these precautionary measures:

• Avoid opening unexpected or suspicious Office attachments.
• Verify the source of Office documents received from external parties.
• Use email security controls to identify and block suspicious attachments.
• Restrict access to untrusted Office documents where operationally feasible.
• Prioritize installation of the official Microsoft security update.

These precautions may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

Critical – Prioritize Security Patch Deployment

CVE-2026-97780 should receive high patching priority because of its Critical severity rating and potential for remote code execution.

Although Microsoft has not identified active exploitation and considers exploitation less likely, the vulnerability has a CVSS score of 8.8, low attack complexity, and requires no prior attacker privileges.

The need for user interaction reduces the likelihood of exploitation, but malicious Office documents remain a possible method of targeting employees.

Organizations should prioritize patch deployment across affected Microsoft Office environments, particularly systems used to process documents received from external sources.

Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 are specifically rated Critical, making them important deployment priorities.

Other affected Office products carry an Important severity rating and should also be updated.

A malicious spreadsheet should never become the reason an organization loses control of its systems or sensitive business information.

Prompt patching will reduce exposure to this vulnerability and help protect critical business operations.