AI analysis
CVE-2026-97780 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel. An unauthorized attacker on the network can trigger it without prior privileges, but the user must interact with malicious content (CVSS 3.1 8.8: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation lets the attacker run code on the affected system with high impact to confidentiality, integrity, and availability. Microsoft lists Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as affected. It is not in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install Microsoft’s October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as soon as they are offered for your update channel. Until then, do not open unsolicited Excel workbooks from email or the web, and confirm the fix on both desktop clients and Office Online Server hosts.
Affected
| Microsoft 365 Apps | Affected releases as identified by Microsoft (no build numbers in the advisory data) |
| Microsoft 365 | Affected releases as identified by Microsoft (no build numbers in the advisory data) |
| Microsoft Office 2021 | Affected Office 2021 releases as identified by Microsoft (no build numbers in the advisory data) |
| Microsoft Office 2024 | Affected Office 2024 releases as identified by Microsoft (no build numbers in the advisory data) |
| Microsoft Office Online Server | Affected Office Online Server releases as identified by Microsoft (no build numbers in the advisory data) |
Estimated exposure
massHundreds of millions of Microsoft 365 and Office installations worldwide — Microsoft publicly reports on the order of hundreds of millions of Microsoft 365 subscribers, and desktop Office is one of the most widely deployed productivity suites; this is an order-of-magnitude estimate of the install base, not a…