Microsoft Office Excel CVE-2026-97775

Exploitation requires a user to open or preview an attacker-crafted Excel file (spreadsheet), consistent with UI:R in the CVSS vector - there is no zero-interaction remote path. No authentication or elevated privileges are needed by the attacker (PR:N), and code executes in the security context of the user who opens the document, so impact is bounded by that user's privileges (S:U). The primary limiting factor is the required user interaction (social-engineering a victim into opening the file); the 'network' vector reflects delivery of the file over email/web rather than a listening network service. Affected deployments include Microsoft Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and the macOS Office editions listed in EUVD.

This is a genuine high-priority vulnerability, though its real-world exploitability is gated by user interaction rather than being a wormable remote flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack requiring no attacker privileges but requiring a victim to open a crafted file (UI:R), yielding full confidentiality, integrity, and availability impact within the user's context. No EPSS probability is provided in the input, so likelihood of mass exploitation cannot be quantified. There is no CISA KEV listing and no public proof-of-concept referenced, so active exploitation cannot be asserted. A notable conflict exists in the metadata: the CWE is CWE-400 (Uncontrolled Resource Consumption, typically a denial-of-service weakness) and one Tag is 'Denial Of Service', yet the description explicitly states 'execute code over a network' and the CVSS shows C:H/I:H/A:H - these signals point to remote code execution (consistent with CWE-416 use-after-free), not DoS. Treat the DoS/CWE-400 labeling as likely inaccurate and rely on the RCE description. Overall: a real priority for patching given Office's enormous install base, but it is not a zero-click internet-facing exploit - the user-interaction requirement meaningfully limits spray-and-pray weaponization.

An attacker crafts a malicious Excel spreadsheet that triggers a use-after-free condition when parsed, then delivers it via phishing email or a web download. When the victim opens the file, memory corruption leads to arbitrary code execution in the context of the current user. No public exploit code is referenced in the available data.