CVE-2026-97741: Microsoft Office Excel Remote Code Execution Vulnerability
Published Oct 13, 2026
·Updated
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office Excel Remote Code Execution Vulnerability
— Microsoft
Affected Software
6 affected componentsFixes available
Microsoft Office Excel
Microsoft Office 365 for Mac
Microsoft 365 Apps for Enterprise<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024
Microsoft Office LTSC for Mac 2021
Microsoft 365 Apps for Enterprise<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
DescriptionSeverity
Frequently Asked Questions
1
Does an attacker need credentials or user interaction to exploit this issue?
The attacker does not need privileges or authentication, but user interaction is required. The attack can be conducted over the network and has low attack complexity.
2
What is the potential impact of successful exploitation?
Successful exploitation can allow code execution and may result in high impact to confidentiality, integrity, and availability.