CVE-2026-97755: Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft Office Excel Remote Code Execution Vulnerability
Other sources
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20228Patch KB5002928 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Frequently Asked Questions
Which deployments are identified as affected?
The affected software list includes Microsoft 365 Apps for Enterprise; Office LTSC 2021 and 2024 for 32-bit and 64-bit editions; Office LTSC for Mac 2024; Office Online Server; and SharePoint Server Subscription Edition.
What level of access and user involvement does exploitation require?
The vector is network-based and requires no attacker privileges, but user interaction is required. The provided data does not specify the exact interaction or delivery mechanism.