CVE-2026-97010

8.8High

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-416

Impact

An unauthorized attacker can execute arbitrary code with the user's permissions, but they must convince a user to open a malicious Excel file first.

Root cause

A use-after-free vulnerability exists in memory management when handling Excel files.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Install the security patch provided in the MSRC update guide for Microsoft Office Excel. If immediate patching is not possible, block untrusted Excel attachments at the email gateway and avoid opening untrusted spreadsheets.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97010PatchVendor Advisory

Source: nvd.nist.gov/vuln/detail/CVE-2026-97010