Microsoft Excel CVE-2026-97762

Exploitation requires the victim to open (or preview) an attacker-crafted Excel workbook in Microsoft Office Excel; the out-of-bounds write is triggered during parsing of the malicious file. The decisive limiting factor is this mandatory user interaction (CVSS UI:R) - there is no server-side or zero-click path in the provided data, so Protected View, Mark-of-the-Web blocking, and user caution against opening untrusted spreadsheets all materially reduce real-world exploitability. Affected configurations span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; code executes with the privileges of the current user, not SYSTEM.

This is a genuine patch-priority item but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H = 8.8 High) indicates network-reachable, low-complexity, unauthenticated code execution with full confidentiality/integrity/availability impact - a classic 'malicious document' RCE profile for Microsoft Office. The critical mitigating signal is UI:R: exploitation is not automatic and requires the victim to open or preview a crafted Excel file, which caps real-world spread relative to a wormable zero-click bug. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so there is no evidence of active exploitation or available exploit code at this time - this contrasts with the high CVSS and should temper urgency toward 'patch promptly' rather than 'under active attack.' Note a minor consistency point to verify: the description says 'unauthorized attacker ... over a network' while AV:N with UI:R is correct for file-delivered Office RCE (the network vector reflects email/web delivery of the file, not a direct network service), so the wording is consistent with the vector. Office Excel's enormous install base means even interaction-gated RCE warrants timely remediation.

An attacker emails a victim a weaponized .xlsx/.xls file (or hosts it on a web page or file share), and when the victim opens it in Excel, a malformed structure triggers an out-of-bounds write that corrupts memory and executes attacker-supplied code in the context of the user. No authentication is required of the attacker, but the attack hinges entirely on the victim opening the file. No public proof-of-concept is identified in the provided data.