AI analysis
CVE-2026-97756 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel, rated high (CVSS 3.1 8.8). An unauthorized attacker can trigger it over a network without prior privileges, but the victim must interact with attacker-controlled content, such as opening a crafted Excel workbook. Successful exploitation can run code with high impact to confidentiality, integrity, and availability on the affected system. It affects Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as soon as they are available. Until systems are patched, treat unsolicited Excel workbooks as untrusted and do not open them, including from email or the web. Confirm patch status in your update management console and prioritize internet-facing or shared Office Online Server hosts.
Affected
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| Microsoft Office 2021 | — |
| Microsoft Office 2024 | — |
| Microsoft Office Online Server | — |
Estimated exposure
massOn the order of 100 million+ Microsoft 365/Office users and devices potentially in scope — Estimate from Microsoft 365 and Office's very large commercial and consumer installed base (hundreds of millions of paid seats and devices worldwide); not from a product-specific vulnerability scan, and not every installation is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.