CVE-2026-97746
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-191
Impact
Remote attackers can execute arbitrary code with the user's permissions. This requires convincing a target user to open a malicious Excel file over the network.
Root cause
An integer underflow vulnerability in Microsoft Excel's data parsing logic leads to memory corruption.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Install the security update from Microsoft for your specific Office/Excel release via Microsoft Update or WSUS; as an interim measure, block untrusted Excel attachments at the email perimeter and warn users against opening unverified spreadsheets.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97746PatchVendor Advisory