Microsoft Excel CVE-2026-97009

Exploitation requires the victim to open an attacker-crafted Excel workbook (UI:R) in a vulnerable Office/Excel build; it is not remotely triggerable without that interaction. Affected configurations per EUVD are Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, and Office LTSC 2024 before 16.0.17932.21056. The AV:L vector reflects that the malicious file must be processed locally by Excel on the target host; mitigations such as Protected View, Mark-of-the-Web blocking, and disabling of risky content reduce exploitability, and code executes only with the privileges of the user who opens the file, so a low-privilege user context limits downstream impact.

This is a credible patch-priority item but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes the classic Office client-side pattern: 'local' attack vector because exploitation occurs when a victim opens a malicious file on the target host, low complexity, no prior privileges needed, but mandatory user interaction. The high confidentiality/integrity/availability impacts reflect arbitrary code execution in the user's context. No EPSS score, SSVC decision data, KEV listing, or POC indicator was provided in the input, so there is no signal of active exploitation or public exploit code - exploitation status is 'no public exploit identified at time of analysis.' The 'unauthorized attacker' phrasing in the description is consistent with PR:N (no authentication to the system needed), but note the hard dependency on UI:R, which materially lowers real-world risk versus a true zero-click remote bug. The main risk driver here is product ubiquity, not exploitability signals, which are absent. Heap-based buffer overflows in Office parsers have a strong historical track record of being weaponized post-disclosure, so patch promptly even though no exploitation is currently evidenced.

An attacker crafts a malicious Excel workbook that triggers a heap-based buffer overflow in Excel's file parser and delivers it via email or a download link. When the victim opens the file (UI:R), memory corruption leads to arbitrary code execution in the context of the logged-in user. No public proof-of-concept or active exploitation was indicated in the provided data.