CVE-2026-97745: Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft Office Excel Remote Code Execution Vulnerability
Other sources
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056
Event History
Frequently Asked Questions
What does an attacker need to exploit this vulnerability?
The attack vector is network-based, requires low complexity, and does not require privileges. User interaction is required, so exploitation depends on a user interacting with attacker-supplied content.
Which deployments should be considered exposed?
The affected software list includes Microsoft 365 Apps for Enterprise, Microsoft Office Excel, Office LTSC 2021 and 2024 in 32-bit and 64-bit editions, Office LTSC for Mac 2024, and Office 365 for Mac. Organizations using any of these listed products should assess their installed update level.
What is the potential impact if exploitation succeeds?
Successful exploitation can allow unauthorized code execution. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.