AI analysis
CVE-2026-97765 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel, scored CVSS 3.1 8.8 (high). A remote, unauthenticated attacker can trigger it by delivering a malicious workbook that a user opens (network attack vector with user interaction required). Successful exploitation can run arbitrary code with the user's privileges, with high impact to confidentiality, integrity, and availability. It affects Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known; it was highlighted among October 2026 Patch Tuesday issues.
What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as soon as they are available for your channel. Until patched, do not open Excel workbooks from untrusted senders or sites, and prefer Protected View or application control so untrusted files cannot run with full user rights.
Affected
| Microsoft 365 Apps | Microsoft 365 Apps (affected builds per Microsoft; exact build numbers not in source data) |
| Microsoft 365 | Microsoft 365 (affected builds per Microsoft; exact build numbers not in source data) |
| Microsoft Office 2021 | Office 2021 (affected builds per Microsoft; exact build numbers not in source data) |
| Microsoft Office 2024 | Office 2024 (affected builds per Microsoft; exact build numbers not in source data) |
| Microsoft Office Online Server | Office Online Server (affected builds per Microsoft; exact build numbers not in source data) |