CVE-2026-97759: Use-after-free remote code execution in Microsoft Excel · ZeroHour

CVE-2026-97759

mass

Use-after-free remote code execution in Microsoft Excel

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-97759 is a use-after-free (CWE-416) flaw in Microsoft Office Excel that lets an unauthorized attacker run code when a user opens crafted content. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the bug is reachable over a network with no privileges, but the victim must interact, typically by opening a malicious spreadsheet. Successful exploitation can fully compromise confidentiality, integrity, and availability on the user’s system. Affected products named in the data are Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024; specific build numbers are not listed. It is not on CISA’s KEV list and no public proof-of-concept is known.

What to do: Apply Microsoft’s October 2026 security updates for Excel in Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 as soon as they are available. Until patched, block or caution users against opening unsolicited Excel files, and prefer Protected View and mail/attachment filtering for Office documents.

Affected

Microsoft 365 Apps	—
Microsoft 365	—
Microsoft Office 2021	—
Microsoft Office 2024	—

Estimated exposure

masson the order of 100 million+ Office/Microsoft 365 users who use Excel — Microsoft 365 and perpetual Office are standard productivity software with well over 100 million commercial and consumer users worldwide; exact vulnerable install counts are not published.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Vendors: microsoft
Products: 365 apps, microsoft 365, office 2021, office 2024
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-97759

In the news1 stories

Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities