CVE-2026-97780
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
An attacker can achieve arbitrary code execution in the context of the current user. To trigger this, a user must open a malicious Excel file received over the network or email.
Root cause
A heap-based buffer overflow occurs when Microsoft Office Excel parses specially crafted file content.
Affected systems
Microsoft Office Excel (specific affected versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the official security update from the Microsoft MSRC advisory. As an interim workaround, block untrusted Excel attachments at the email gateway and ensure Office Protected View is enforced.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97780PatchVendor Advisory