Microsoft Office Excel: Remote code execution via heap-based buffer overflow

Summary

Microsoft Office Excel contains a heap-based buffer overflow (CWE-122) that allows remote code execution. An attacker can run code on a victim's system by getting a user to open a crafted Excel file or link, so user interaction is required, while no privileges or authentication are needed. Affected are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, Office LTSC for Mac 2021 and 2024, and Office Online Server. Microsoft's CISA SSVC data lists exploitation as none at the time of the record.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 to below the build listed at https://aka.ms/OfficeSecurityReleases (exact build unknown)
• Office 365 for Mac: 1.0.0 to below 16.114.26101123
• Office LTSC 2021: 16.0.1 to below 16.0.14334.20974
• Office LTSC 2024: 16.0.0 to below 16.0.17932.21056
• Office LTSC for Mac 2021: 16.0.1 to below 16.114.26101123
• Office LTSC for Mac 2024: 16.0.0 to below 16.114.26101123
• Office Online Server: 16.0.0.0 to below 16.0.10417.20228

Fixed in

• Office LTSC 2021: 16.0.14334.20974 or later (according to third-party records, not yet confirmed on the MSRC page)
• Office LTSC 2024: 16.0.17932.21056 or later (according to third-party records, not yet confirmed on the MSRC page)
• Office 365 for Mac: 16.114.26101123 or later (according to third-party records; a conflicting syndicated copy of the MSRC text mentions Mac updates)
• Office Online Server: 16.0.10417.20228 or later (matching Microsoft KB5002928)
• Microsoft 365 Apps for Enterprise (Windows): Unknown. Check the MSRC Security Update Guide.
• Office LTSC for Mac 2021 and 2024: Unknown (sources show only a placeholder).

Workaround

No workaround is documented. Patching is the only documented remedy.

• Interim measures (general guidance, not from the vendor): keep Protected View and macro restrictions enabled and block or quarantine untrusted Excel files from email and downloads until patched.

Exploitation

• Microsoft lists Exploited: No and Exploit Code Maturity: Unproven.
• Not listed in the CISA KEV catalogue. EPSS score: Unknown.
• No public proof of concept or exploit code was found during research. This does not prove that none exists.

Our recommendation

• Apply the October 2026 Office security updates to all Windows and Mac desktop installations and to Office Online Server servers.
• Verify the installed build numbers after patching against the MSRC Security Update Guide, because some fixed builds are not yet confirmed by the vendor.
• Until patched, block or quarantine untrusted Excel files from email and downloads, and train users not to open unexpected attachments or links.
• Monitor for addition to the CISA KEV catalogue and for public exploit code.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-97007 msrc.microsoft.com
• Microsoft 365 Apps security updates (October 13, 2026) learn.microsoft.com
• Microsoft Office Online Server hotfix KB5002928 support.microsoft.com
• Vulners: CVE-2026-97007 vulners.com
• OpenCVE: CVE-2026-97007 app.opencve.io
• Strix: CVE-2026-97007 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:48.