Microsoft Excel CVE-2026-97763

Exploitation requires the victim to open (or render in the preview pane) a maliciously crafted Excel workbook - the UI:R in the CVSS vector reflects this mandatory user interaction, which is the primary limiting factor. No authentication is required (PR:N), so any unauthorized attacker who can get a file in front of a user (email attachment, download, shared drive) can attempt it, and it works against default Excel configurations with no special feature toggle noted in the description. Affected products per EUVD include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; code executes only at the privilege level of the user who opens the file, so a non-admin user limits blast radius to that account absent further escalation.

This is a genuinely high-priority vulnerability, though not the top-tier 'patch-tonight' emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) shows network reach, low attack complexity, and no privileges required, yielding full confidentiality/integrity/availability compromise - classic arbitrary code execution. The single meaningful limiter is UI:R: a user must open or preview a malicious Excel file, which is why the score is 8.8 rather than 9.8. No EPSS score, no KEV listing, and no POC indicator are present in the provided data, so exploitation is not confirmed to be occurring or trivially available. There is no SSVC decision data supplied. The signals are internally consistent (no CVSS-vs-description conflict), but the exploitation-likelihood dimension is simply MISSING rather than low - absence of EPSS/KEV/POC must not be read as 'low risk.' Given that malicious-Office-document attacks are a perennial, heavily-weaponized phishing vector and a vendor patch already exists, this should be treated as a near-term patching priority despite the lack of active-exploitation evidence.

An attacker emails or otherwise delivers a specially crafted Excel spreadsheet that triggers a heap-based buffer overflow when parsed. When the victim opens the file, the overflow corrupts heap memory and allows the attacker to execute arbitrary code in the context of the user running Excel. No public exploit code was identified in the provided data at time of analysis.