Microsoft Excel CVE-2026-97772

Exploitation requires the victim to open an attacker-crafted Excel file in a vulnerable Office/Excel build (UI:R); it is not a drive-by or zero-interaction network attack. No authentication or special privileges are needed (PR:N) and no non-default configuration is required - any default Excel installation in the listed version ranges (e.g., Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps, and the Mac editions) is exposed. The primary limiting factor is the required user action of opening the malicious document; Protected View and disabling of untrusted content can further blunt real-world exploitation.

This is a genuine high-priority vulnerability, though not quite in the 'drop everything' tier reserved for zero-click or actively-exploited flaws. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects a network-deliverable, unauthenticated, low-complexity memory-corruption bug (CWE-415 double free) yielding full C:H/I:H/A:H impact - the classic Office RCE profile. The single most important mitigating signal is UI:R: exploitation is not automatic and requires the victim to open a crafted Excel file, which places this in the 'malicious document / phishing' threat model rather than the wormable-remote-service model. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no evidence of active exploitation or public exploit code at this time; the realistic risk is therefore driven by Excel's enormous install base and the proven effectiveness of weaponized Office documents as an initial-access vector, rather than by any confirmed in-the-wild activity. Note a data conflict to verify: the input Tags include 'Authentication Bypass,' which is inconsistent with a double-free code-execution bug (CWE-415) and with the CVSS vector - this tag appears mislabeled and should not influence triage.

An attacker emails a victim a specially crafted Excel spreadsheet (or hosts it on a web page/share) and uses social engineering to get them to open it. When Excel parses the malicious content, a double-free condition is triggered, corrupting heap memory and allowing the attacker to execute arbitrary code in the context of the user. No public exploit code was identified in the provided data, so exploitation currently depends on an attacker independently developing a reliable primitive for this double free.