EUVD-2026-100300
GHSA-5jhx-6vrg-fq93
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via email/web
-
DeliveryUser opens malicious workbook
-
ExploitTrigger heap buffer overflow in Excel parser
-
ExecutionExecute arbitrary code in user context
-
ImpactCompromise host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Excel workbook (UI:R) in Microsoft Office Excel - including Microsoft 365 Apps for Enterprise and the Office LTSC/365 for Mac builds listed in EUVD; the malicious file must be delivered to and opened by the user (e.g., via email attachment or download). No authentication or prior privileges are needed (PR:N) and no special non-default configuration is indicated by the description. The primary limiting factor is the mandatory user interaction: Protected View, Mark-of-the-Web blocking, or simply not opening untrusted spreadsheets will prevent the overflow from being reached, so defenders can treat user-interaction controls as a meaningful mitigation despite the high base score. |
| Impact | CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity, unauthenticated code-execution flaw whose only brake is required user interaction (UI:R) - consistent with the classic 'open a malicious spreadsheet' Office RCE pattern rather than a wormable server-side bug. No EPSS probability, CISA KEV entry, SSVC decision, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the elevated score is driven by impact (C:H/I:H/A:H) and ease of trigger, not by observed in-the-wild activity. Net assessment: a genuine patch-priority item because Excel is heavily deployed and the flaw yields full code execution in the user's context, but the UI:R requirement means exploitation depends on social engineering, lowering real-world risk relative to a zero-click network bug. Key missing signals (EPSS, KEV, POC) should be revisited as the CVE matures - absence here reflects data not yet supplied, not a confirmed low-threat verdict. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a specially crafted Excel workbook to a target and lures them into opening it; parsing the malicious content triggers a heap-based buffer overflow (CWE-122) that runs attacker-controlled code with the victim's privileges. No authentication is needed (PR:N) and attack complexity is low (AC:L), but the user must open the file (UI:R). No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Opening an attacker-crafted Excel workbook in affected Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac builds can trigger a heap-based buffer overflow (CWE-122) that lets an unauthenticated remote attacker execute code in the context of the victim user, earning a CVSS 3.1 base score of 8.8 (High). Delivery is network-based and requires no credentials or special configuration, but the attacker must persuade the victim to open the malicious file (UI:R), so a successful email attachment or download plus user action is sufficient to reach the vulnerability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the mandatory user-interaction step means Protected View, Mark-of-the-Web blocking, and attachment filtering remain meaningful brakes despite the high base score.
RemediationAI
Patch by applying the current Microsoft Office security updates referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97741; Microsoft 365 Apps for Enterprise and the Mac 365/LTSC builds should be updated to the latest builds published on the Microsoft 365 Apps security release channel (https://aka.ms/OfficeSecurityReleases), since affected EUVD entries (16.0.1 on Windows, 1.0.0/16.0.0/16.0.1 on macOS) are channel-serviced rather than fixed at a standalone version - exact fixed build numbers should be taken from the vendor advisory rather than assumed. Because exploitation requires the user to open a crafted workbook, the highest-value compensating controls are delivery-stage and open-stage hardening: keep Mark-of-the-Web and Protected View enabled (trade-off: Protected View can break macros, ActiveX, and embedded objects in legitimate documents and adds friction/click-through prompts, and users can be trained but not forced to click 'Enable Editing'), block or quarantine untrusted Excel attachments and internet-sourced .xls/.xlsx/.xlsb files at the email gateway and web proxy (trade-off: false positives on business file sharing; allow-listing by sender or hash reduces that friction), and enforce macro-blocking policy - noting that blocking macros will not by itself stop a file-parsing heap overflow, so it should be layered with the input-file controls. For Mac fleets, ensure Office for Mac and Microsoft 365 Apps update automatically, since the affected LTSC and 365 for Mac builds are only remediated by moving to the vendor's current published builds.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-97741 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel, the spreadsheet component of Microsoft 365 Apps and the Office LTSC/365 desktop suites for Windows and macOS. The weakness class indicates that Excel allocates a heap buffer while processing structures inside a spreadsheet file and then writes or copies more data than that buffer was sized to hold, corrupting adjacent heap memory; a successful attacker can turn that corruption into controlled code execution within the Excel process, which runs with the privileges of the logged-in user. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a remotely deliverable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) issue whose only prerequisite is that the victim opens the file (UI:R); the scope is unchanged (S:U), and confidentiality, integrity, and availability impacts are each rated High (C:H/I:H/A:H) because the attacker gains code execution in the user's context. The affected product set recorded in EUVD-2026-100300 covers Microsoft 365 Apps for Enterprise 16.0.1, Microsoft Office 365 for Mac 1.0.0, Microsoft Office LTSC for Mac 2024 16.0.0, and Microsoft Office LTSC for Mac 2021 16.0.1, with the Windows fix stream tracked through the Microsoft 365 Apps update release page.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-delivered RCE: network-deliverable (AV:N) and unauthenticated (PR:N) but requires the user to open a crafted workbook (UI:R), yielding full code execution (C/I/A:H) in the user's context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity memory corruption flaw in Microsoft 365 Apps for Enterprise and the Mac editions of Office 365 and Office LTSC allows an attacker to gain code execution on a victim's workstation simply by getting them to open a crafted Excel file, with no credentials required. Because the file arrives through ordinary email or web download and runs with the victim's own rights, any employee who handles spreadsheets is a potential entry point, and a single successful open could give an intruder a foothold on an endpoint with access to corporate data and connected services. Leadership should treat this as a workforce-wide exposure affecting both Windows and Mac user populations until Microsoft ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce Protected View and Mark-of-the-Web for files originating from the internet so untrusted workbooks open in a sandboxed read-only state; block or strip Excel attachments at the email and web gateway, particularly from external senders; enable Attack Surface Reduction rules for Office (block child processes, block executable content, block Win32 API calls from Office macros); disable or restrict macros and ActiveX in Office trust-center policy; deploy EDR detections for Excel spawning PowerShell, cmd, or script interpreters; and restrict local admin rights so a successful exploit runs with limited privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB