Microsoft Excel CVE-2026-97008

Exploitation requires a victim running a vulnerable Office/Excel build (e.g., Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Office Online Server before 16.0.10417.20228, plus Microsoft 365 Apps for Enterprise and the Mac editions) to OPEN an attacker-supplied crafted Excel file; the memory-corruption bug is reached through Excel's file-parsing path. The key LIMITING factor is the mandatory user interaction (CVSS UI:R) - the attack cannot fire without the user opening the malicious document, so Protected View, Mark-of-the-Web blocking, and user awareness all materially reduce real-world exploitability. No special non-default configuration or pre-existing authentication is needed beyond the victim opening the file.

This is a genuine high-priority vulnerability by signal convergence, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact, gated only by user interaction (UI:R) - consistent with the classic 'victim opens a malicious Excel document' pattern for a CWE-124 buffer underwrite. However, several escalation signals are ABSENT from the provided intelligence: no EPSS probability was supplied, there is no CISA KEV listing, no POC/exploit-code indicator, and no SSVC decision data. Per the precision rules, exploitation status is therefore 'no public exploit identified at time of analysis' - this must NOT be read as safe, only as not-yet-observed. The practical risk driver is the enormous install base of Office/Excel combined with the low barrier (one click on a crafted file), offset by the UI:R requirement which removes fully automatable/wormable exploitation. Note one data-quality conflict to flag for triage: the input Tags include 'Authentication Bypass,' which contradicts the actual weakness (memory-corruption RCE, CWE-124) and the CVSS impact profile - treat that tag as spurious, not as a second vulnerability class. Net: patch on a prompt enterprise cadence (this is a user-interaction RCE in ubiquitous software), but there is no confirmed active exploitation requiring same-day emergency response from the data provided.

An attacker emails or shares a specially crafted Excel spreadsheet (e.g., as an attachment or download link); when the targeted user opens it in a vulnerable Office/Excel build, the buffer underwrite is triggered during file parsing and attacker-controlled code executes in the user's security context. Because CVSS specifies AV:N/AC:L/PR:N with UI:R, exploitation is reliable and unauthenticated but depends on the single step of the victim opening the file. No public exploit code is identified in the provided data.