CVE-2026-97766

Summary

A heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code on affected systems when processing malicious Excel files. This vulnerability could enable attackers to gain full control over vulnerable systems without requiring user interaction beyond opening the file.

Exploitability

Exploitation is moderately difficult as it requires a remote attacker to deliver a specially crafted Excel file that triggers the buffer overflow, but once triggered, code execution is highly likely with no user interaction required.

Blast radius

The vulnerability affects all Microsoft 365 apps and Office versions including Office 2021 and Office 2024, making it potentially widespread across enterprise environments where Excel is commonly used.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Deploy the Microsoft Security Update KB5040890 immediately to address this vulnerability in affected Office versions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.