Microsoft Excel CVE-2026-97011

Exploitation requires a user to open an attacker-crafted Excel document in Microsoft Office Excel (CVSS UI:R); it is not reachable against a default idle installation without that interaction. No authentication is required of the attacker (PR:N) and no special non-default configuration is indicated in the description - any supported build in the EUVD-listed ranges (e.g. Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, and Mac editions) that opens the malicious file is at risk. The primary limiting factors are the mandatory user interaction and the need for successful social-engineering delivery (email attachment or download); Protected View / Mark-of-the-Web gating may further impede automatic triggering.

This is a genuine patch-priority item, though not an emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes the classic Microsoft Office file-format RCE profile: network-reachable delivery, low attack complexity, no privileges required, but mandatory user interaction (UI:R) - meaning a victim must open a malicious Excel document. The UI:R requirement is the single biggest mitigating factor and is why this is 8.8 rather than 9.8. No EPSS score, no CISA KEV listing, and no POC signal are present in the provided data, so there is no evidence of active exploitation or public exploit code; this should be treated as no public exploit identified at time of analysis rather than an actively-exploited zero-day. Office file-format RCEs are historically attractive to phishing and commodity-malware operators once details or patches are reverse-engineered, so the absence of a current POC does not imply durable low risk. Note a data inconsistency: the assigned CWE-763 is 'Release of Invalid Pointer or Reference,' whereas the description states 'use of uninitialized resource,' which is CWE-908 - the weakness classification should be verified with the vendor advisory.

An attacker emails a crafted .xlsx/.xls file (or hosts it for download) to a target and uses social engineering to get them to open it in Microsoft Excel. On open, Excel's use of an uninitialized resource is triggered, corrupting program state and allowing the attacker to execute arbitrary code in the context of the user. No public exploit code is identified in the provided data, so this scenario reflects the CVSS vector (AV:N/AC:L/PR:N/UI:R) rather than an observed in-the-wild technique.