CVE-2026-97747

Summary

A use-after-free vulnerability in Microsoft Office Excel allows remote attackers to execute arbitrary code when a malicious file is opened. This occurs when the application frees memory that is still being referenced, potentially leading to memory corruption and code execution.

Exploitability

Exploitation requires a user to open a specially crafted Excel file, making it moderately difficult but achievable through social engineering or phishing campaigns.

Blast radius

If exploited, this vulnerability could allow attackers to execute code on affected systems with the privileges of the logged-in user, potentially leading to full system compromise and data exfiltration across Microsoft 365 apps and Office versions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Deploy the Microsoft Office 2021 update KB5047890 or Office 2024 update KB5047891 immediately, as these contain the necessary patches for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.