Microsoft Office Excel: Remote code execution via uninitialized resource
Summary
Microsoft Office Excel in Microsoft 365 Apps and Office LTSC editions (Windows and Mac) contains a use of uninitialized resource flaw. A remote attacker can execute code on an affected system over the network. Exploitation requires that a user interacts with a crafted file, for example by opening an attachment or download. Microsoft rates the severity as Important, and no public exploitation is known.
Affected
- Microsoft 365 Apps for Enterprise (Windows, 16.0.1 up to the fixed build listed by Microsoft)
- Office 365 for Mac (1.0.0 up to 16.114.26101123)
- Office LTSC 2021 (16.0.1 up to the fixed build listed by Microsoft)
- Office LTSC 2024 (16.0.0 up to the fixed build listed by Microsoft)
- Office LTSC for Mac 2021 and 2024 (up to 16.114.26101123)
Fixed in
- Microsoft 365 Apps for Enterprise: October 13, 2026 security update (build linked from the Microsoft CNA record)
- Office 365 for Mac and Office LTSC for Mac: 16.114.26101123 or later
- Office LTSC 2021 and LTSC 2024: October 13, 2026 security update; check the exact build numbers on the MSRC advisory
- Fixes are listed under Excel in the Microsoft Office release notes for October 13, 2026
Workaround
Unknown. No vendor workaround is listed in the sources. Patching is the stated remedy.
- Interim measure (general practice, not from the sources): block or sandbox untrusted Office attachments and keep Protected View enabled.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC data: exploitation none, automatable no, technical impact total.
- Microsoft exploit code maturity: unproven.
- EPSS below 1%.
- No public proof of concept or in-the-wild exploitation found. Treat as not known, not confirmed absent.
Our recommendation
- Install the October 2026 Office security update on all Microsoft 365 and Office LTSC clients, Windows and Mac.
- Confirm build numbers on the MSRC advisory, not only on third-party sites.
- Prioritise staff who regularly open external files or email attachments.
- Until patched, block or sandbox untrusted Office attachments and keep Protected View enabled.
- Monitor for suspicious Office document activity.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-97011 msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- Vulners: CVE-2026-97011 (CNA record) vulners.com
- OpenCVE: CVE-2026-97011 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:44.
Original description (NVD)
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.