Microsoft Excel CVE-2026-97007

Requires the victim to open an attacker-supplied, specially crafted Excel document (UI:R) in an affected build of Microsoft Office/Microsoft 365 Apps/Office LTSC/Office Online Server. No authentication is required of the attacker (PR:N), and default configurations are vulnerable - there is no special feature flag or non-default setting needed. The primary limiting factor is the mandatory user interaction (opening the file); Protected View / Mark-of-the-Web sandboxing and user security-awareness reduce real-world exploitability, and execution occurs only in the context of the opening user rather than at elevated privilege.

This is a credible, high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated heap-based buffer overflow (CWE-122) yielding full confidentiality, integrity, and availability impact - i.e., arbitrary code execution. The key tempering signal is UI:R: exploitation requires a victim to open a maliciously crafted Excel file, so this is a classic file-/phishing-delivered RCE rather than a self-propagating remote service bug. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization at time of analysis; the risk is driven by the product's ubiquity and the low technical barrier once a user is socially engineered. Note a common framing nuance: the 'over a network' / AV:N label reflects email/web delivery of the document, not a listening network service - the actual exploitation primitive is local file parsing gated by user interaction. Vendor-confirmed patch availability makes prioritized patching the correct response despite the absence of exploitation telemetry.

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a user into opening it. When Excel parses the malformed structure, a heap-based buffer overflow is triggered, allowing the attacker to execute arbitrary code in the context of the current user. No public exploit code was identified in the provided data.