CVE-2026-97756

Summary

A heap-based buffer overflow in Microsoft Office Excel allows remote attackers to execute arbitrary code when processing malicious Excel files. This vulnerability is particularly dangerous because it can be triggered over a network without user interaction, making it ideal for remote exploitation.

Exploitability

Exploitation is moderately difficult and requires an attacker to deliver a specially crafted Excel file to a victim who has Microsoft Office installed, though the attack can be automated through web delivery or email attachments with minimal user interaction required.

Blast radius

The vulnerability affects multiple Microsoft 365 applications including Excel, Office 2021, and Office 2024, potentially allowing widespread remote code execution across enterprise environments that use these products.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Deploy the Microsoft Security Update KB5040497 for Office 2021 and Office 2024, or ensure all affected Microsoft 365 applications are updated to version 2408 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.