Microsoft Excel CVE-2026-97004

Exploitation requires a user to open or preview a malicious attacker-crafted Excel file (per CVSS UI:R) - delivery is network-capable (email, web, file share) but code execution does not occur until the victim opens the document, which is the primary limiting factor. No authentication or elevated privileges are required on the attacker side (PR:N), and no special victim-side configuration is implied by the description; default Office installations that process spreadsheet files are exploitable. Scope is unchanged (S:U), so code runs with the privileges of the user who opened the file, meaning least-privilege user accounts and Protected View / Mark-of-the-Web blocking of untrusted documents materially reduce realistic risk.

This is a credible, actionable priority rather than an inflated high-CVSS artifact. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, unauthenticated-to-trigger memory-corruption RCE (CWE-122 heap overflow) with full confidentiality, integrity, and availability impact - the classic profile of a maliciously crafted Office document that runs code when opened. The single meaningful mitigating signal in the vector is UI:R: a human must open the attacker-supplied Excel file, so this is not wormable/self-propagating. Key risk signals are MISSING and must not be invented: no EPSS score was provided, there is no CISA KEV listing in the input, and no public POC/exploit code is referenced, so the exploitation status is 'no public exploit identified at time of analysis.' That absence should not be read as low risk - Office file-format RCEs in this class are historically high-value for phishing/spear-phishing campaigns and frequently see exploit development after patch release. A vendor patch is confirmed available, and the issue was reported through Microsoft's own security channel (secure@microsoft.com), which lends high confidence to the vulnerability's legitimacy. Net: patch urgently given ubiquity of Office, but note that real-world exploitation likelihood (EPSS) and in-the-wild status (KEV) could not be quantified from the data supplied.

An attacker emails or otherwise delivers a specially crafted Excel spreadsheet (e.g., via phishing or a shared document link). When a user opens the file, the malformed content triggers a heap-based buffer overflow in Excel's parsing code, allowing the attacker to execute arbitrary code in the context of the user. No public exploit code is identified in the provided data, though this vulnerability class is commonly weaponized after disclosure.