Microsoft Excel CVE-2026-97003

Exploitation requires a user to open or preview a specially crafted Excel workbook in an affected build (per EUVD: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server). No authentication is needed on the attacker side (PR:N), but the mandatory limiting factor is user interaction (UI:R) - the victim must be socially engineered into opening the malicious file; the overflow does not trigger passively without that action. Code executes in the context of the opening user, so account privilege level bounds the immediate impact. Office Online Server being listed means server-side document processing could also be an exposure path where untrusted workbooks are rendered. Standard mitigations (Protected View, Mark-of-the-Web blocking, or the vendor patch) materially reduce real-world exploitability.

This is a credible high-priority issue but not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-deliverable, unauthenticated, low-complexity remote code execution gated only by user interaction - the canonical 'open a malicious Excel file' pattern. Full CIA impact (C:H/I:H/A:H) and a patched heap overflow (CWE-122) reported directly by Microsoft's own security team raise its weight. However, the mitigating signals matter: UI:R means no exploitation occurs without a user opening a crafted workbook, so this is phishing-dependent rather than wormable. On the exploitation-likelihood side the data is thin - there is NO EPSS score provided, NO CISA KEV listing, and NO evidence of public exploit code, so this is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. Net: treat as an important patch-soon item for any Office-exposed environment given ubiquity and RCE potential, but absent EPSS/KEV/POC signals there is no evidence of active or imminent widespread exploitation. Note one metric to verify: AV:N is standard Microsoft convention for malicious-document RCE (file arrives over the network) even though the trigger is local file-open - defenders should read this as 'remote delivery, local execution via user action,' not remote unauthenticated server exploitation.

An attacker crafts a malicious Excel workbook that triggers a heap-based buffer overflow in Excel's file-parsing code and delivers it via phishing email, a shared drive, or a web download. When a victim opens the file, memory corruption leads to arbitrary code execution in the context of the user, giving the attacker a foothold on the endpoint. No public proof-of-concept exploit is known at the time of analysis, so this scenario is inferred from the CVSS vector (AV:N/AC:L/UI:R) and the heap-overflow CWE.