CVE-2026-97777
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
Remote attackers can execute arbitrary code on the victim's system, but they require a user to open a malicious Excel file. Successful exploitation gives the attacker the privileges of the local user running Excel.
Root cause
A heap-based buffer overflow in Microsoft Office Excel mishandles file data parsing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the Microsoft update for Excel referenced in the MSRC advisory. As an interim workaround, block inbound emails carrying untrusted spreadsheet attachments or open untrusted Excel files exclusively in Microsoft Office Protected View or an isolated sandbox.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97777PatchVendor Advisory