CVE-2026-97750

Summary

A stack-based buffer overflow in Microsoft Office Excel allows remote attackers to execute arbitrary code when processing malicious Excel files. This vulnerability is particularly dangerous because it can be triggered over a network without user interaction, making it ideal for drive-by downloads.

Exploitability

Exploitation requires a victim to open a specially crafted Excel file, but the attack can be delivered remotely via email attachments or web downloads with minimal user interaction needed.

Blast radius

If exploited, this vulnerability could allow attackers to gain full control of affected systems, potentially leading to data breaches, lateral movement, and persistent access across Microsoft 365 environments.

Detection

Monitor for unusual Excel process activity in Windows Event Logs, particularly Event ID 4688 for new process creation involving excel.exe with suspicious command-line parameters or file paths that may indicate exploitation attempts.

Prioritized remediation

Deploy the Microsoft Office 2021 Security Update KB5047890 or Microsoft Office 2024 Security Update KB5047891 immediately, as these patches address the buffer overflow vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.