Microsoft Excel CVE-2026-97756

Exploitation requires the victim to open an attacker-crafted Excel spreadsheet (CVSS UI:R), typically delivered by phishing or a malicious download; it cannot be triggered without this user action. No authentication is required of the attacker (PR:N), and no special victim-side configuration is needed beyond running an affected Excel build - affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server below the patched builds (e.g. Office LTSC 2024 < 16.0.17932.21056, Office LTSC 2021 < 16.0.14334.20974, Office Online Server < 16.0.10417.20228). The code executes in the context of the user who opens the file, so a low-privileged user account limits the immediate blast radius; Protected View / Mark-of-the-Web warnings and user caution before enabling content are the primary limiting factors.

This is a genuine high-priority vulnerability, though not a drop-everything emergency based on available signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects network-reachable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact - but the UI:R flag is decisive: exploitation requires a victim to open a malicious Excel file, so this is a client-side, user-interaction-gated flaw rather than a wormable server-side bug. No EPSS probability was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so the two strongest real-world exploitation signals (active exploitation, weaponized POC) are absent or unknown. SSVC-style reasoning: exploitation status = none observed, automatable = no (requires user to open a file, so not amenable to mass automated exploitation), technical impact = total. Reported internally by Microsoft (secure@microsoft.com) with a patch already available, which is typical of a coordinated internal discovery rather than in-the-wild discovery. Net assessment: treat as a priority patch for the next Office update cycle given the ubiquity of Excel and total technical impact, but the mandatory user interaction and lack of any exploitation evidence place it below actively-exploited or unauthenticated-RCE items. Note: EPSS score is missing from the input and cannot be weighed - obtain it to refine prioritization.

An attacker crafts a malicious Excel spreadsheet that triggers a heap-based buffer overflow in Excel's file parser and delivers it via phishing email or a download link. When the targeted user opens the attachment, the overflow corrupts heap memory and allows arbitrary code execution in the user's security context. Because CVSS specifies UI:R, the attack cannot succeed without the victim opening the file; no public exploit code is identified at time of analysis.