CVE-2026-97778: Integer overflow RCE in Microsoft Office Excel · ZeroHour

CVE-2026-97778

mass

Integer overflow RCE in Microsoft Office Excel

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-97778 is an integer overflow or wraparound (CWE-190) in Microsoft Office Excel. An unauthorized attacker can trigger it over the network, but the victim must interact with the malicious content (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation can run code with high impact to confidentiality, integrity, and availability on the affected system. Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server are listed as affected. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as soon as they are available. Until systems are patched, treat unexpected Excel files as untrusted and do not open them, including attachments and links delivered by email.

Affected

Microsoft 365 Apps	—
Microsoft 365	—
Microsoft Office 2021	—
Microsoft Office 2024	—
Microsoft Office Online Server	—

Estimated exposure

masson the order of hundreds of millions of Office/Microsoft 365 users (estimate) — Microsoft 365 and desktop Office are deployed across consumer and enterprise environments at a scale publicly described in the hundreds of millions of users; this is an order-of-magnitude estimate of who could be affected before patching,…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Vendors: microsoft
Products: 365 apps, microsoft 365, office 2021, office 2024, office online server
Weakness: CWE-190
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-97778

In the news1 stories

Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities