CVE-2026-77902: Microsoft Office Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office Excel Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
Does an attacker need an account or prior privileges to exploit this issue?
No. The vulnerability is rated PR:N, indicating that no attacker privileges are required.
Is user interaction required for exploitation?
Yes. The UI:R rating indicates that exploitation requires user interaction.
Which Office deployments should be assessed?
Assess Microsoft 365 Apps for Enterprise; Microsoft Office 365 for Mac; Office LTSC 2021 for 32-bit and 64-bit editions and for Mac; and Office LTSC 2024 for 32-bit and 64-bit editions and for Mac.