EUVD-2026-99816
GHSA-cw7p-jc38-4h69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via phishing
-
DeliveryUser opens malicious workbook
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host and user data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the targeted user to open a specially crafted Excel workbook (UI:R) - this is the primary limiting factor, as the attack is not fully automatic and depends on user action, typically via phishing/social engineering or a document delivered through email, web, or file share. No authentication is required (PR:N), and the attacker runs code in the context of the user who opened the file, so impact is bounded by that user's privileges. Affected products per EUVD include Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, Office LTSC/365 for Mac, and Office Online Server; environments patched to the listed fixed builds (e.g., 16.0.17932.21056 for LTSC 2024) are not exploitable. |
| Impact | This is a genuine patch-priority item, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes network-reachable, low-complexity, unauthenticated code execution with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), yielding 8.8. The one meaningful brake is UI:R - a user must open a malicious Excel file, which is why this scores 8.8 rather than ~9.8. Exploitation status is 'no public exploit identified at time of analysis': the input contains no KEV flag, no POC indicator, and no EPSS score, so there is no evidence of active exploitation or public exploit code. EPSS is MISSING from the input, so no exploitation-probability signal is available to compare against the CVSS score. No SSVC decision data was provided. The dominant risk driver is therefore prevalence plus attacker economics: Office/Excel is a ubiquitous phishing target and malicious-document RCE in Excel is a historically favored, frequently weaponized bug class, so defenders should treat the UI:R brake as weak and prioritize patching even absent current KEV/EPSS signals. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a crafted Excel workbook to a target user; when the user opens it, a heap-based buffer overflow (CWE-122) is triggered in Excel's parsing code, executing attacker-supplied code in the context of the user. No public proof-of-concept is identified in the provided data, and the AV:N/AC:L vector means exploitation is network-deliverable and low-complexity once the user opens the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
RemediationAI
Vendor-released patches are available, and remediation should begin with updating Excel to the fixed builds: Microsoft Office LTSC 2024 to 16.0.17932.21056 or later, Microsoft Office LTSC 2021 to 16.0.14334.20974 or later, Office Online Server to 16.0.10417.20228 or later, and Microsoft 365 Apps for Enterprise to the current channel release listed at https://aka.ms/OfficeSecurityReleases; Mac editions (Office LTSC for Mac 2024/2021 and Office 365 for Mac) should be updated via the corresponding publication-covered releases. Where patching must be staged, compensating controls include enforcing Protected View for files from the Internet and other untrusted locations, using Microsoft Defender Application Guard for Office, and applying attack surface reduction rules such as "Block Office applications from creating child processes" and "Block Office applications from injecting code into other processes" - noting these may break legitimate macro or add-in workflows and can generate false positives. Additionally, mail-flow rules to quarantine or strip Excel attachments (XLS/XLSX/XLSM) from external senders and restricting which users can open externally sourced workbooks reduce exposure, though each can disrupt normal business file exchange and should be scoped to high-risk populations. The primary vendor reference is the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97776.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel's handling of crafted spreadsheet content, where an out-of-bounds write in heap memory can corrupt adjacent structures and be shaped into code execution. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows the attack is network-deliverable and requires no credentials (PR:N), but hinges on user interaction (UI:R) because the victim must open the malicious Excel file; exploitation is therefore not fully automatic and depends on social engineering or delivery through email, web, or a file share. Impact is scoped to the privileges of the user who opens the document (S:U), with high confidentiality, integrity, and availability consequences. EUVD records affected products across Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, and environments patched to the listed fixed builds are not exploitable.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based RCE is network-deliverable (AV:N) and low-complexity (AC:L) but needs no auth (PR:N) and requires the victim to open the file (UI:R); code runs as the user with full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity remote code execution flaw in Microsoft Excel (CVE-2026-97776) allows an attacker to run malicious code on an end user's machine when that user simply opens a crafted workbook, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, Office for Mac, and Office Online Server. Because the payload arrives as an ordinary-looking document, the most likely delivery path is email phishing, a web-hosted file, or a shared drive - meaning any employee who opens spreadsheets from external sources is a potential entry point. With no public exploit code identified at time of analysis, exploitation is opportunistic rather than widespread, but the breadth of affected builds and the attacker's ability to execute code under the victim's own credentials make prompt patching a leadership-level priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB