AI analysis
CVE-2026-97753 is a heap-based buffer overflow (CWE-122), associated with an integer overflow (CWE-190), in Microsoft Office Excel. A remote, unauthenticated attacker can deliver a malicious spreadsheet over the network; the flaw is triggered when a user opens that file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation can run code with the user's privileges and fully compromise confidentiality, integrity, and availability on that system. Affected products named in the advisory data are Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server; exact build ranges were not provided. It is not listed in CISA KEV, no public proof-of-concept is known, and it was highlighted among October 2026 Patch Tuesday issues.
What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as soon as they are available for your channel. Until patched, block or quarantine unexpected Excel files from email and the web, and avoid opening spreadsheets from untrusted sources. Confirm Office is current in the update history after rollout; no public workaround is described in the advisory data.
Affected
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| Microsoft Office 2021 | — |
| Microsoft Office 2024 | — |
| Microsoft Office Online Server | — |
Estimated exposure
massOn the order of hundreds of millions of Office/Excel users and installations — Microsoft 365 and desktop Office, including Excel, are standard on most business PCs and a large share of consumer PCs; Microsoft has publicly cited on the order of hundreds of millions of Microsoft 365 users, so vulnerable Excel clients…