Microsoft Excel CVE-2026-97760

Exploitation requires the targeted user to open an attacker-crafted Excel file (UI:R) - this is the primary limiting factor and means attacks are per-victim and social-engineering-dependent rather than automatable (CISA Automatable: no). No authentication is required (PR:N) and no special non-default Excel configuration is indicated by the description; any affected Office/Excel build parsing the malicious document is exposed. The impact is confined to confidentiality (C:H only): the attacker obtains disclosed in-process memory, not code execution or data modification, so the flaw does not by itself grant foothold or persistence.

This is a moderate-severity information-disclosure flaw that signals should NOT be over-prioritized. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-delivered, low-complexity, unauthenticated issue, but exploitation hinges on required user interaction (UI:R) - the victim must open a malicious Excel file. Impact is confidentiality-only (C:H, I:N, A:N): an out-of-bounds read (CWE-125) leaks process memory, with no code execution or integrity/availability loss. The supporting signals all point to low real-world urgency: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', which is internally consistent with a read-only memory-disclosure bug that cannot be mass-automated because it needs per-victim social engineering. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit is referenced. There is no conflict among the signals - they coherently describe a patchable, non-automatable, user-interaction-gated disclosure bug. Prioritize via normal patch cycles rather than emergency response. Note one tagging caveat: the input tag 'Buffer Overflow' is imprecise, as CWE-125 describes an out-of-bounds READ (over-read), not a classic overflow write.

An attacker crafts a malicious Excel spreadsheet and delivers it via email or a web link; when the targeted user opens it, a parser reads memory beyond an allocated buffer and leaks adjacent process memory (potentially heap pointers or document/application secrets) back to attacker-controlled content or rendering. No public exploit code is referenced at time of analysis, and success depends entirely on the victim opening the file.