AI analysis
CVE-2026-97755 is an out-of-bounds read (CWE-125) in Microsoft Office Excel that Microsoft rates CVSS 3.1 8.8 (high). A remote, unauthenticated attacker can trigger it over the network if a user opens a crafted Excel file (user interaction required, no privileges required, unchanged scope). Successful exploitation can lead to code execution with high impact on confidentiality, integrity, and availability. Affected products named in the advisory data are Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, Office Online Server, and SharePoint Server; exact build ranges are not listed in the source data. It is not on the CISA KEV list and no public proof-of-concept is known; coverage has appeared in Microsoft October 2026 Patch Tuesday reporting.
What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, Office Online Server, and SharePoint Server as soon as they are available for your channel. Until patched, do not open Excel files from untrusted senders or sites, and prefer Protected View for documents from outside the organization.
Affected
| Microsoft 365 Apps | Affected builds not enumerated in the source data |
| Microsoft 365 | Affected builds not enumerated in the source data |
| Microsoft Office 2021 | Affected builds not enumerated in the source data |
| Microsoft Office 2024 | Affected builds not enumerated in the source data |
| Microsoft Office Online Server | Affected builds not enumerated in the source data |
| Microsoft SharePoint Server | Affected builds not enumerated in the source data |