AI analysis
CVE-2026-97758 is a heap-based buffer overflow (CWE-122) in Microsoft Excel, scored 8.8 (high). A remote attacker needs no prior privileges but does need a user to open or otherwise interact with a malicious spreadsheet delivered over the network, such as by email or a web download. Successful exploitation can run attacker-controlled code in the user's context with high impact to confidentiality, integrity, and availability. Affected products named in the advisory data are Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for Excel across Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as soon as they are available. Until systems are patched, block or quarantine untrusted Excel files from email and the web, and prefer Protected View or Application Guard for Office where it is already enabled. Confirm patch status in your endpoint-management console rather than relying on file reputation alone.
Affected
| Microsoft 365 Apps | Affected builds per Microsoft advisory; exact build numbers not in source data |
| Microsoft 365 | Affected builds per Microsoft advisory; exact build numbers not in source data |
| Microsoft Office 2021 | Affected builds per Microsoft advisory; exact build numbers not in source data |
| Microsoft Office 2024 | Affected builds per Microsoft advisory; exact build numbers not in source data |
| Microsoft Office Online Server | Affected builds per Microsoft advisory; exact build numbers not in source data |