CVE-2026-97758

Summary

A heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code when processing maliciously crafted Excel files. This vulnerability could be exploited by an unauthenticated attacker over a network without requiring user interaction.

Exploitability

Exploitation is moderately difficult as it requires crafting a specific malicious Excel file and convincing a target to open it, but the attack surface is large due to widespread Excel usage and lack of exploit code availability.

Blast radius

The vulnerability affects multiple Microsoft 365 applications and Office versions, potentially enabling attackers to compromise a large number of endpoints across organizations that use these applications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Deploy the Microsoft Security Update KB5049127 for Excel 2021 and Office 2024, or upgrade to Microsoft 365 Apps for enterprise version 2408 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.