AI analysis
CVE-2026-97776 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel, rated high (CVSS 3.1 base 8.8). An unauthorized attacker can trigger it over a network with no privileges required, but the victim must interact with crafted content, such as opening a malicious workbook. Successful exploitation can give the attacker code execution in the user's context with high impact to confidentiality, integrity, and availability. Affected products named by Microsoft are Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server. It is not listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known; it was discussed among prominent issues in October 2026 Patch Tuesday coverage.
What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as soon as they are available for your channel. Until then, do not open Excel workbooks from untrusted sources and prefer Protected View for files received by email or download. Confirm Office Online Server hosts are patched as well as desktop and Microsoft 365 clients.
Affected
| Microsoft 365 Apps | Affected releases identified by Microsoft (no build numbers in source data) |
| Microsoft 365 | Affected releases identified by Microsoft (no build numbers in source data) |
| Microsoft Office 2021 | Affected releases identified by Microsoft (no build numbers in source data) |
| Microsoft Office 2024 | Affected releases identified by Microsoft (no build numbers in source data) |
| Microsoft Office Online Server | Affected releases identified by Microsoft (no build numbers in source data) |