CVE-2026-97769
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-20, CWE-122
Impact
Attackers can execute arbitrary code with the privileges of the local user if a user opens a maliciously crafted Excel file over the network. They need no prior authentication, but user interaction is required.
Root cause
A heap-based buffer overflow occurs due to improper input validation during file processing in Microsoft Office Excel.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the official security update provided by Microsoft in the MSRC advisory. As an interim workaround, block untrusted Excel attachments at the email gateway and avoid opening untrusted spreadsheets.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97769PatchVendor Advisory