Microsoft Excel CVE-2026-97738

Exploitation requires the victim to open an attacker-supplied malicious Excel workbook (UI:R) in an affected build of Microsoft Office Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server per the EUVD version list). No attacker authentication or prior privileges are needed (PR:N), and attack complexity is low (AC:L). The primary limiting factor is the mandatory user interaction of opening the file; Protected View, Mark-of-the-Web blocking, and disabling preview/automatic rendering reduce realistic exploitability. Code runs in the context of the user who opened the document, so low-privilege user accounts limit immediate blast radius.

This is a credible, actionable priority despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes an unauthenticated (PR:N), low-complexity remote code-execution path whose only meaningful gate is user interaction (UI:R) - i.e., the victim must open a crafted Excel workbook. This matches the classic Office client-side RCE profile, which is historically among the most reliably weaponized vulnerability classes (phishing-delivered documents). On the mitigating side, no EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is NOT confirmed active exploitation and should not be treated as such. The signals are therefore consistent rather than conflicting: high theoretical impact and ease, but no evidence yet of in-the-wild use. One data note: the input Tags include 'Denial Of Service,' which conflicts with the description and CVSS impact metrics that indicate full code execution (C:H/I:H/A:H), not merely availability loss - treat the DoS label as an artifact of the memory-corruption (CWE-416 use-after-free) root cause rather than the actual impact. EPSS is absent (not low), so no probability-based deprioritization is warranted. Net: patch on normal-to-expedited cadence; a vendor patch is already available.

An attacker emails or otherwise delivers a specially crafted Excel spreadsheet to a target and lures them into opening it. On open, Excel's parsing of the malicious content triggers a use-after-free (CWE-416), corrupting memory to achieve arbitrary code execution in the context of the user who opened the file. No authentication is required of the attacker and complexity is low, but success depends on the victim opening the document (UI:R); no public exploit code was identified at the time of analysis.