AI analysis
CVE-2026-97741 is a heap-based buffer overflow, also associated with an off-by-one error, in Microsoft Office Excel. A remote attacker who needs no prior privileges can trigger it by getting a user to open a crafted workbook, which matches the CVSS 3.1 score of 8.8 (network, low complexity, no privileges, user interaction required). Successful exploitation can run arbitrary code with high impact to confidentiality, integrity, and availability on the user's system. It affects Excel in Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024; specific patched build numbers were not included in the source data. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 as soon as they are offered. Until then, do not open Excel workbooks from untrusted senders or sites, and keep Protected View and macro restrictions enabled. No public exploit is known and the flaw is not on the CISA KEV list, but opening a crafted file is enough to trigger it.
Affected
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| Microsoft Office 2021 | — |
| Microsoft Office 2024 | — |
Estimated exposure
massOn the order of hundreds of millions of Microsoft 365 and Office users (estimate, not a vulnerable-install count) — Estimate only: Microsoft 365 and perpetual Office are deployed globally across consumers and enterprises, with public subscriber and commercial-seat figures in the hundreds of millions, so an Excel flaw spanning Microsoft 365 Apps,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.