Microsoft Excel CVE-2026-97747

Exploitation requires the victim to open a maliciously crafted Excel file (UI:R in the CVSS vector) - this is the primary limiting factor and means the attack is not zero-click. No authentication is required of the attacker (PR:N), and no special target-side configuration is indicated; default Excel installations that process attacker-supplied workbooks are affected. The main constraints on real-world exploitation are therefore: (1) successful social-engineering to get the user to open the file, and (2) the target running an unpatched build within the affected ranges (e.g., Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Office Online Server before 16.0.10417.20228, plus Mac and Microsoft 365 Apps editions). Protected View / Mark-of-the-Web may further blunt exploitation for files downloaded from the internet, though this is not stated in the source data.

This is a genuine high-priority vulnerability but not a drop-everything emergency based on currently available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring no privileges but DOES require user interaction (UI:R) - consistent with the classic Office attack model of a victim opening a malicious Excel file. The high confidentiality, integrity, and availability impact reflects the use-after-free (CWE-416) yielding arbitrary code execution in the user's context. Critically, several key risk signals are MISSING from the input: no EPSS exploitation-probability score is provided, there is no CISA KEV listing, and no proof-of-concept is referenced - so no public exploit identified at time of analysis. Contrast this with the vector: although the mechanics are attractive to attackers (Office RCE chains are commonly weaponized historically), there is no evidence in this dataset of active or imminent exploitation. The UI:R requirement meaningfully lowers real-world risk versus a zero-click bug. Net assessment: patch on a normal-to-expedited Patch Tuesday cadence; this is a real priority for environments running Office, but the absence of KEV/EPSS/POC data means it should not currently be treated as actively exploited.

An attacker crafts a malicious Excel workbook that triggers the use-after-free condition and emails or otherwise delivers it to a target. When the victim opens the file in a vulnerable version of Excel, the freed-object reuse is triggered and attacker-controlled code executes in the context of the user. No proof-of-concept is referenced in the available data, and low attack complexity means a reliable exploit, if developed, would likely work against default configurations once the user opens the file.