AI analysis
CVE-2026-97745 is a use-after-free flaw (CWE-416) in Microsoft Office Excel. An unauthorized attacker can reach it over a network with low complexity and no prior privileges, but the victim must interact, typically by opening a crafted spreadsheet. Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability in the user's security context. Microsoft lists Microsoft 365, Microsoft 365 Apps, Office 2021, and Office 2024 as affected; exact build ranges were not included in the source data. It is not on the CISA KEV catalog, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for Excel and the Office or Microsoft 365 channel you run, matching the official advisory for CVE-2026-97745 (no fixed build numbers were in this dataset). Until the update is applied, do not open Excel files from untrusted senders or sites, and keep Protected View enabled. Confirm the patch on both perpetual Office 2021/2024 installs and Microsoft 365 Apps.
Affected
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| Microsoft Office 2021 | — |
| Microsoft Office 2024 | — |
Estimated exposure
massHundreds of millions of Microsoft 365 and Office users (order-of-magnitude) — Excel ships with Microsoft 365, Microsoft 365 Apps, and perpetual Office 2021 and 2024, product lines with a publicly reported global seat count in the hundreds of millions; the CVE data gives no per-build install count.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.