CVE-2026-97747
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416
Impact
An unauthorized attacker can execute arbitrary code with the user's permissions over the network. They require a user to open a malicious Excel file.
Root cause
A use-after-free memory flaw in Microsoft Excel triggers when handling crafted spreadsheet data.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Install the security update from Microsoft for Microsoft Excel via Windows Update or Microsoft Endpoint Configuration Manager. As an interim workaround, block or quarantine untrusted incoming Excel attachments at the email gateway.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97747PatchVendor Advisory