Microsoft Excel CVE-2026-97754

Exploitation requires the victim to open a maliciously crafted Excel workbook in a vulnerable version (UI:R in the CVSS vector) - it is not a server-side or zero-click flaw despite the AV:N network rating, which here reflects remote delivery of the file rather than remote triggering. Code executes in the context of the user who opens the file, so impact is bounded by that user's privileges. No authentication is required of the attacker (PR:N), and the affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office/Office LTSC for Mac; Protected View, Office hardening policies, and attachment/file-origin blocking materially limit real-world exploitation. Patched builds (e.g. Office LTSC 2021 16.0.14334.20974, Office LTSC 2024 16.0.17932.21056, Office Online Server 16.0.10417.20228) remove the condition.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper finding. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact - the single meaningful mitigating factor is UI:R, meaning a user must open a malicious Excel file. This is the classic, historically heavily-abused Office document attack pattern, and a vendor patch is already available via MSRC, confirming Microsoft treats it as fixable and real. That said, several escalation signals are MISSING rather than confirmed: no EPSS score was provided, there is no CISA KEV listing in the input, and no proof-of-concept is referenced, so per the available data this is 'no public exploit identified at time of analysis.' The signals are therefore consistent rather than conflicting - a serious, patch-available Office RCE whose real-world exploitation is plausible and historically common for this bug class, but not yet evidenced as active. Priority is high primarily due to the ubiquity of Excel and the low technical barrier once a user is socially engineered into opening a file.

An attacker crafts a malicious Excel workbook that triggers a heap-based buffer overflow (CWE-122) and emails or shares it with a target. When the victim opens the file in a vulnerable Excel version, the overflow corrupts heap memory and allows the attacker to execute arbitrary code in the user's security context. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to open the attacker-supplied file (UI:R).