Microsoft Excel CVE-2026-97755

Exploitation requires a user to open (or, depending on client preview configuration, preview) a specially crafted Excel workbook - this user interaction (UI:R) is the primary limiting factor and means the attack is client-side and file-delivery-based despite the AV:N rating. No attacker authentication or prior access is needed (PR:N). Note that affected products extend beyond desktop Excel to server-side Office document processing (Office Online Server and SharePoint Server Subscription Edition builds are listed in the EUVD data), so environments that render or process uploaded Excel files server-side may expand the exposure surface. Unpatched builds below the fixed versions (e.g. Office LTSC 2021 <16.0.14334.20974, Office LTSC 2024 <16.0.17932.21056, SharePoint Server Subscription Edition <16.0.20326.20190) are required for exploitability.

This is a genuine high-priority issue given the product footprint, though several severity signals must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless REQUIRES user interaction (UI:R) - meaning the 'network' vector is realized through file delivery (email attachment, download, SharePoint/Office Online Server processing) and a victim opening or previewing a crafted Excel document, not a server-side remote exploit. There is a notable internal tension worth flagging: the CWE is CWE-125 (out-of-bounds READ) and the Tags include 'Information Disclosure', yet the description and the C:H/I:H/A:H impact claim full remote code execution - an OOB read alone typically yields disclosure, so the RCE outcome likely depends on the read primitive being chained with other memory-corruption behavior; treat the RCE characterization as vendor-asserted rather than mechanically obvious from the CWE. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no evidence of active exploitation or automatable mass exploitation - this is a high-CVSS issue whose real-world urgency rests primarily on the enormous deployment base of Office/Excel and the historically high rate at which Office file-format bugs are weaponized, not on any confirmed in-the-wild signal here.

An attacker crafts a malicious Excel workbook with malformed structures that trigger an out-of-bounds read in Excel's parsing code and emails it to a target or hosts it for download. When the victim opens (or previews, depending on client configuration) the file, the flaw is triggered and the attacker achieves code execution in the context of the user. No authentication is required of the attacker, but the attack cannot proceed without the victim opening the file (UI:R); no public exploit code was identified at time of analysis.