AI analysis
CVE-2026-97767 is a double-free flaw (CWE-415; CWE-476 is also assigned) in Microsoft Office Excel. An unauthorized attacker can trigger it over a network with low complexity and no prior privileges, but the user must interact (CVSS UI:R), which for Excel typically means opening a crafted workbook or similar content. Successful exploitation can run attacker code with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server are listed as affected. It is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for Excel, Microsoft 365 Apps, Office 2021, Office 2024, and Office Online Server as soon as they are available. Until patched, do not open Excel files from untrusted sources and prefer Protected View. Confirm the update is installed across managed endpoints and Office Online Server hosts.
Affected
| Microsoft 365 Apps | Affected builds as listed in Microsoft's advisory (exact build numbers not in source data) |
| Microsoft 365 | Affected builds as listed in Microsoft's advisory (exact build numbers not in source data) |
| Microsoft Office 2021 | Affected builds as listed in Microsoft's advisory (exact build numbers not in source data) |
| Microsoft Office 2024 | Affected builds as listed in Microsoft's advisory (exact build numbers not in source data) |
| Microsoft Office Online Server | Affected builds as listed in Microsoft's advisory (exact build numbers not in source data) |
Estimated exposure
massHundreds of millions of Office/Microsoft 365 users with Excel (order-of-magnitude estimate) — Microsoft 365 and perpetual Office (including Excel) are deployed across consumer and enterprise desktops worldwide; public subscriber and install figures are on the order of hundreds of millions of users, so affected installations are…