Microsoft Excel CVE-2026-97770

Exploitation requires a victim to open or preview a specially crafted Excel spreadsheet file in an affected version of Microsoft Office/Microsoft 365 Apps (the UI:R interaction). No authentication or prior access is needed (PR:N), and the file can be delivered remotely via email or web (AV:N), executing in the context of the user who opens it. The primary limiting factor is this mandatory user interaction - the attack cannot succeed without someone opening the malicious document - which rules out automated/wormable exploitation and makes user awareness and Protected View meaningful mitigations. Affected products per EUVD include Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, Office LTSC for Mac 2024/2021, Office 365 for Mac, and Office Online Server; patched builds are specified per product (e.g., LTSC 2024 at 16.0.17932.21056).

This is a genuine high-priority vulnerability, though not the top tier of the 'drop everything' category. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-deliverable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact - the classic profile of a malicious-document attack. The single mitigating metric is UI:R: a victim must open or preview a crafted Excel file, so this is not wormable or self-propagating. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or weaponization at this time. The combination of a ubiquitous product, a vendor patch already available, and a well-understood exploitation primitive (stack-based buffer overflow, CWE-121) means this class of bug is historically attractive to phishing and targeted-intrusion actors once patch-diffing reveals the flaw. Signals are internally consistent - no conflict between the CVSS network vector and the description, which also states network-based code execution by an 'unauthorized' (unauthenticated) attacker. Priority: patch promptly, especially on endpoints that handle externally sourced spreadsheets.

An attacker emails or hosts a malicious .xlsx/.xls file and lures a user into opening it (e.g., a phishing lure or a document on a shared drive). When Excel parses the crafted content, a stack-based buffer overflow is triggered, allowing arbitrary code execution in the context of the user. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to open the file (UI:R).