Microsoft Excel CVE-2026-97766

Exploitation requires a victim to open an attacker-crafted Excel spreadsheet in a vulnerable build of Microsoft Office Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC/365 for Mac, or Office Online Server per the EUVD affected list). The decisive limiting factor is UI:R - the attack cannot succeed without user interaction (opening/previewing the file), so it is not zero-click or self-propagating. No authentication is required of the attacker (PR:N), and no special non-default configuration is indicated; the flaw affects default spreadsheet-parsing functionality. Code executes in the context of the user who opens the file, so a low-privilege user account limits the immediate blast radius to that user's privileges.

This is a genuine high-priority patch item, though not an emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated code-execution flaw with full confidentiality, integrity, and availability impact - but the crucial moderating signal is UI:R (user interaction required). In practice this is a classic malicious-document scenario: the 'network' vector means the crafted file is delivered remotely (email, web, share), not that a service is remotely attackable without a victim. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the signals, but note the gap: a high CVSS driven partly by the broad impact metrics coexists with a real-world dependency on social engineering, which lowers the practical likelihood versus a zero-click network RCE. The combination of ubiquitous product footprint plus a vendor patch availability makes prompt patching worthwhile, but the UI:R requirement means this is not self-propagating and should be prioritized below any comparable no-interaction flaw.

An attacker crafts a malicious Excel spreadsheet that triggers a heap-based buffer overflow (CWE-122) during parsing and emails it to a target or hosts it on a web/file share. When the victim opens the file in a vulnerable version of Microsoft Office Excel, the overflow corrupts heap memory and allows arbitrary code execution in the user's security context. No public exploit code is referenced in the available data, and successful attack depends on convincing the user to open the file (UI:R).