Microsoft Excel CVE-2026-97757

Exploitation requires a user to open an attacker-crafted Excel file (UI:R), making social engineering such as phishing the realistic delivery mechanism; it does not require prior authentication or privileges on the target (PR:N) and works against default Office configurations since file parsing is core functionality. The primary limiting factors are: the mandatory user interaction (no fully automated/remote trigger), execution occurring only in the opening user's security context (S:U, so no automatic privilege elevation), and the presence of standard Office mitigations such as Protected View, which can block the parsing path for files received from the internet or email until the user explicitly enables editing.

This is a genuine high-priority patch item, though not a drop-everything emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects network-reachable, unauthenticated, low-complexity exploitation with high impact to confidentiality, integrity, and availability - but the UI:R requirement (a user must open a malicious workbook) is the single most important mitigating signal and is what keeps this from being a wormable 9.8. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or published exploit code at time of analysis; this contrasts with the high CVSS, meaning real-world risk is currently driven by potential rather than observed abuse. The absence of EPSS data means exploitation probability cannot be quantified from the input - it should not be read as 'low.' Office client-parser RCEs of this class are historically attractive to phishing and commodity-malware actors, so despite no current exploitation signal, the combination of ubiquitous deployment, an available patch (implying public disclosure), and a classic heap-overflow file-parsing bug makes prompt patching warranted. Treat as high priority; re-evaluate urgency upward immediately if a POC surfaces or it is added to CISA KEV.

An attacker crafts a malicious Excel spreadsheet that triggers the heap-based buffer overflow in Excel's file parser and delivers it via phishing email, a shared drive, or a web download. When the victim opens the file, memory corruption occurs and attacker-controlled code executes in the context of the user. Low attack complexity makes reliable exploitation feasible, but the required user interaction (opening the file) is the gating factor; no public exploit code is identified at time of analysis.