EUVD-2026-99829
GHSA-3jf6-crcr-95mc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via phishing
-
DeliveryVictim opens document in Excel
-
ExploitTrigger integer overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host and data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Microsoft Excel file (UI:R in the CVSS vector), making successful attacks dependent on social engineering or file delivery rather than fully autonomous remote compromise. No authentication is required of the attacker (PR:N), and no special target-side configuration is indicated - default Excel installations that open the malicious document are affected. The primary limiting factor is the mandatory user action of opening the file; Protected View / Mark-of-the-Web warnings and disabling of risky content can further reduce exposure. Affected builds per EUVD include Office LTSC 2021 (<16.0.14334.20974), Office LTSC 2024 (<16.0.17932.21056), Office Online Server (<16.0.10417.20228), the Mac LTSC/365 editions, and Microsoft 365 Apps for Enterprise. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-delivered, low-complexity, unauthenticated code-execution flaw whose only gating factor is user interaction - the victim must open a malicious Excel document. The HIGH/HIGH/HIGH impact (C:H/I:H/A:H) with unchanged scope yields the 8.8 score, consistent with full compromise of the user's security context. Reported directly by Microsoft (secure@microsoft.com) and a vendor patch is available, confirming legitimacy. However, exploitation-prediction signals are absent from the input: no EPSS probability, no CISA KEV listing, and no POC/SSVC data are provided, so there is no public exploit identified at time of analysis. The practical risk therefore rests on the documented ease of weaponizing Office file-format bugs via phishing combined with Office's enormous install base, not on confirmed in-the-wild activity. Treat as a priority patch for any Office deployment, while noting that the real-world exploitation likelihood cannot be quantified from the data given (EPSS/KEV/POC all missing). |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted .xlsx/.xls file that triggers an integer overflow (CWE-190) during Excel's parsing of the file. When the targeted user opens the document, the overflow corrupts memory and leads to arbitrary code execution in the user's context. No public exploit code was identified in the provided data, but the AV:N/AC:L/UI:R profile makes this well-suited to phishing-style delivery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.
RemediationAI
Apply the vendor patch - Microsoft states a fix is available from the vendor, and the EUVD affected-version thresholds indicate the remediated builds as Office LTSC 2021 16.0.14334.20974 or later, Office LTSC 2024 16.0.17932.21056 or later, Office Online Server 16.0.10417.20228 or later, and the current Microsoft 365 Apps for Enterprise build distributed via https://aka.ms/OfficeSecurityReleases; Mac LTSC and Office 365 for Mac editions should be updated to the versions published by Microsoft, with full details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97778. Prioritize the Microsoft 365 Apps and Mac channels that update on a rolling cadence, since users on the Current Channel may already have received the fixed build while LTSC and Office Online Server installations require explicit patching. Until updates are deployed, keep Protected View and Mark-of-the-Web enforcement enabled for documents from the internet and email (side effect: legitimate external spreadsheets open in a restricted, read-only sandbox and may require the user to explicitly enable editing, which adds friction but does not block the attack entirely because the user can still choose to trust the file). Additional compensating controls with trade-offs include blocking or quarantining untrusted XLSX/XLS/XLSM attachments and downloads at the mail gateway, proxy, and endpoint layers (side effect: false positives on business-critical spreadsheets and operational overhead in maintaining allowlists), disabling macros and legacy Excel formats where they are not required via Group Policy or the Trust Center (side effect: breaks macro-driven business workflows), and restricting Office Online Server document-opening endpoints to trusted internal sources (side effect: reduces external collaboration capability). None of these controls substitutes for patching; they only raise the cost of delivery and reduce the likelihood that a user opens the malicious file.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190, an integer overflow or wraparound, occurring inside Microsoft Excel's parsing and calculation logic for spreadsheet content. When Excel computes a size, offset, or length value from attacker-controlled data in the document, the arithmetic can wrap past the bounds of the integer type, producing a value far smaller (or differently signed) than intended. That corrupted value is then used to allocate memory or index into it, and the mismatch results in an out-of-bounds write - the associated tags of Integer Overflow and Buffer Overflow describe exactly this two-stage failure: the overflow enables the subsequent memory corruption. Because the corrupted structure lives in the Excel process that opens the file, the code executes with the privileges of the interacting user, giving high confidentiality, integrity, and availability impact within that user's context. The attack surface is the Excel document parser itself rather than a network service, which is why the CVSS vector shows network delivery (AV:N) combined with mandatory user interaction (UI:R), and why mitigations such as Protected View and Mark-of-the-Web checks are directly relevant to reducing exposure. No affected CPE strings were supplied; product scope is instead defined by the EUVD version ranges for the Office desktop, Mac, Office Online Server, and Microsoft 365 Apps for Enterprise channels.
Know when Excel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based Office RCE delivered over the network with no attacker privileges but requiring the victim to open the document (UI:R), yielding full user-context impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Excel is affected by a high-severity remote code execution vulnerability (CVE-2026-97778) that could allow an attacker to execute arbitrary code if a user opens a malicious spreadsheet. This affects organizations using Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Mac editions, potentially leading to data theft or system compromise. No public exploit identified at time of analysis, and a vendor patch is available, making immediate remediation critical to protect sensitive information and maintain business continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 all
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compati
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to exec
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer a
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Off
Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; an
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Heap-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 Gold and SP1, Excel Viewer, and Office Compatibi
Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2008 and 2011 for Mac; Excel Viewer; and Offic
Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allow
Exploit-DB