CVE-2026-97011: Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft Office Excel Remote Code Execution Vulnerability
Other sources
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must deliver or make available a malicious Excel file and convince a user to interact with it. The vector is network-based, but the vulnerability requires user interaction.
Does exploitation require an existing account or elevated privileges?
No. The supplied CVSS vector indicates that no privileges are required before exploitation.
What is the potential impact if exploitation succeeds?
Successful exploitation can allow code execution and may affect confidentiality, integrity, and availability at a high level.