CVE-2026-97763: Microsoft Office Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office Excel Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20228Patch KB5002928 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
Does an attacker need valid credentials to exploit this issue?
No. The vector lists privileges required as none, and the vulnerability is described as exploitable by an unauthorized attacker.
Is user interaction required for exploitation?
Yes. The attack vector specifies that user interaction is required, so exploitation depends on an affected user taking an action.
What is the potential impact if exploitation succeeds?
Successful exploitation can allow remote code execution and has high impacts to confidentiality, integrity, and availability.