Microsoft Excel CVE-2026-97743

Exploitation requires the victim to open an attacker-crafted Excel workbook in a vulnerable Microsoft Excel build (Microsoft 365 Apps for Enterprise, Office LTSC for Mac 2021/2024, or Office 365 for Mac); the use-after-free is triggered during file parsing/rendering. The decisive limiting factor is UI:R - mandatory user interaction (opening the document) - which prevents fully automated or wormable exploitation and is reflected in SSVC Automatable:'no'. No authentication is required (PR:N) and no special non-default configuration is indicated; the primary barrier is social-engineering the user into opening the file. Impact is limited to information disclosure (C:H only), not code execution or system compromise.

This is a moderate-priority vulnerability, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-deliverable, low-complexity, unauthenticated use-after-free whose only impact is high confidentiality loss (information disclosure) with no integrity or availability effect. The AV:N rating reflects that the malicious Excel file is delivered over a network (email/web), but UI:R means a user must actually open the file, which meaningfully limits mass exploitation. All exploitation signals point toward low real-world risk: there is no CISA KEV listing and no public POC (no public exploit identified at time of analysis), and the CISA SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial' - consistent with the confidentiality-only, user-interaction-gated nature of the flaw. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be incorporated. One conflict worth noting: the input Tags include 'Denial Of Service', but the CVSS vector shows A:N (no availability impact) and C:H, so this is an information-disclosure bug, not a DoS - the DoS tag appears mislabeled and should not drive prioritization. Overall this is a legitimate but not urgent patch-in-normal-cycle issue absent evidence of exploitation.

An attacker crafts a malicious Excel workbook that triggers a use-after-free condition and emails it to a target or hosts it for download. When the victim opens the file in a vulnerable version of Excel, the freed-memory access causes previously allocated heap contents (potentially including sensitive data) to be disclosed back to the attacker. No public exploit code has been identified at time of analysis, and successful exploitation hinges on convincing the user to open the file.