Microsoft Excel CVE-2026-97010

Exploitation requires the victim to open an attacker-crafted Excel workbook in a vulnerable Microsoft Office/Excel build (per EUVD: Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the Mac Office LTSC 2021/2024 and 365 for Mac builds). The decisive limiting factor is mandatory user interaction (UI:R) - there is no server-side or zero-click path in the stated vector; the attacker cannot trigger the use-after-free without the user opening the malicious file. No authentication or elevated privileges are required of the attacker (PR:N), and no special victim-side configuration is indicated beyond running an unpatched Excel version. Protected View / Mark-of-the-Web prompts may add friction but are not stated as a mitigation in the available data.

This is a genuine high-priority issue, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-deliverable, low-complexity, unauthenticated flaw whose single gating factor is user interaction (UI:R) - the victim must open a malicious workbook. All three impact metrics are High (C:H/I:H/A:H), consistent with CWE-416 use-after-free leading to arbitrary code execution in the user's security context. A vendor patch is confirmed available (Microsoft MSRC). The signals are largely coherent: the 'network' attack vector here reflects Office's standard file-delivery-over-network threat model (email/web download) rather than a listening service, so 'remote code execution over a network' really means 'open a crafted file received over the network' - this is the normal reading for Office document RCE and is not a contradiction, but defenders should understand it as client-side rather than server-side exploitation. Key signals are MISSING: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so real-world exploitation probability cannot be quantified from this input. Absence of KEV/EPSS is not evidence of safety - it is simply unmeasured here. Net: treat as a high-severity client-side RCE warranting prompt patching, but without current evidence of active or automated exploitation.

An attacker emails a victim a crafted Excel workbook (or hosts it on a web page/share) that, when opened, triggers a use-after-free in Excel's parsing/object handling. The freed-then-reused memory is manipulated to hijack control flow and execute attacker code in the context of the user who opened the file. No public exploit code is identified in the provided data, and successful exploitation depends on the user opening the file (UI:R).