Microsoft Excel CVE-2026-97768

Exploitation requires the victim to open a specially crafted Microsoft Excel file (UI:R in the CVSS vector) - this is the defining prerequisite and the primary limiting factor, as there is no zero-click path. No authentication or prior privileges on the target are required (PR:N), and the flaw is reachable via network-delivered content (email attachment, download, or shared file). Code executes in the context of the opening user, so privilege is bounded by that user's rights rather than SYSTEM/admin. Mitigations such as Protected View, Mark-of-the-Web blocking, or disabling file opens from untrusted sources reduce the likelihood of successful exploitation. Applies to the affected Office/Excel builds listed in EUVD-2026-100304 (Office LTSC 2024/2021, Office LTSC/365 for Mac, Office Online Server, Microsoft 365 Apps for Enterprise).

This is a genuine high-priority vulnerability, though not the absolute top tier of urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-delivered, low-complexity, unauthenticated code-execution flaw whose only gating factor is required user interaction (UI:R) - the victim must open a malicious workbook. This is the classic 'malicious document' RCE profile for Office. However, the signals are incomplete: no EPSS exploitation-probability score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is indicated in the input. Thus there is no public exploit identified at time of analysis, and there is no evidence of active exploitation. The combination of a ubiquitous product, full CIA impact, and no required privileges makes this attractive to attackers and a strong patching priority, but in the absence of KEV or POC/EPSS data the real-world exploitation pressure cannot be quantified from the provided data and should be treated as 'high potential, unconfirmed activity.' The UI:R requirement meaningfully lowers risk relative to a zero-click flaw: exploitation depends on social engineering success.

An attacker emails a crafted Excel spreadsheet (or hosts it on a web/file share) to a target and lures them into opening it. On open, malformed data triggers a heap-based buffer overflow (CWE-122) in Excel's parser, allowing the attacker to execute arbitrary code in the user's security context. No public exploit is identified at time of analysis, and the network attack vector with required user interaction means delivery typically relies on phishing.