Microsoft Excel CVE-2026-97779

Exploitation requires a user to open or preview an attacker-supplied, specially crafted Excel file (UI:R) in an affected, unpatched version of Microsoft Office Excel - fixed builds include Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228. No authentication or prior access to the target system is needed (PR:N), and no special non-default configuration is called out in the advisory. The decisive LIMITING factor is the mandatory user interaction: without a victim opening the malicious document, the vulnerability cannot be triggered, which rules out fully automated, server-side, or wormable exploitation and caps technical impact at partial per CISA SSVC.

This is a moderate-priority information-disclosure flaw rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-delivered attack requiring no privileges but mandating user interaction (UI:R) - consistent with the client-side nature of an Excel parsing bug where a victim must open a malicious workbook. Impact is confined to confidentiality (C:H) with no integrity or availability effect, matching CWE-125 (out-of-bounds read / memory disclosure). Multiple non-severity signals converge to LOWER the practical urgency: CISA's SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no identified public exploit code. These signals are mutually consistent (no conflict) and all point to targeted, interaction-dependent exploitation rather than mass automated attacks. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here - this is a data gap, not a low score. The 'C:H' confidentiality rating is vendor-assigned; out-of-bounds reads often disclose adjacent heap/stack memory of uncertain sensitivity, so defenders should treat 'high confidentiality impact' as the worst-case ceiling. Overall: a legitimate patch-in-normal-cycle item, elevated only by the ubiquity of Microsoft Office, not a drop-everything issue.

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a target into opening it (phishing/social engineering), since exploitation requires user interaction. When Excel parses the malformed file structure, an out-of-bounds read exposes uninitialized or adjacent process memory, which can be relayed back to disclose potentially sensitive information. No public exploit identified at time of analysis, so this remains a theoretical-but-credible vector against unpatched clients.