Office Excel: Remote code execution via use-after-free
Summary
A use-after-free flaw in Microsoft Office Excel (CWE-416) allows an unauthorized attacker to execute code over the network with a CVSS base score of 8.8. Exploitation requires that a user opens a crafted file, for example one received by email or downloaded, so phishing is the main risk. Microsoft rates exploit code maturity as unproven, and no public proof of concept or exploitation has been confirmed.
Affected
- Microsoft 365 Apps for Enterprise: versions below the build listed at https://aka.ms/OfficeSecurityReleases (exact range not confirmed)
- Office 365 for Mac: versions below 16.114.26101123
- Office LTSC 2021: versions below 16.0.14334.20974
- Office LTSC 2024: versions below 16.0.17932.21056 (per third-party source, not confirmed in the CNA record)
- Office LTSC for Mac 2021: versions below 16.114.26101123
- Office LTSC for Mac 2024: versions below 16.114.26101123
- Office Online Server: versions below 16.0.10417.20228 (per third-party source, not confirmed)
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown. Check https://aka.ms/OfficeSecurityReleases or the MSRC page.
- Office LTSC 2021: 16.0.14334.20974 or later
- Office 365 and LTSC for Mac: 16.114.26101123 or later
- Office LTSC 2024: Unknown (to be confirmed)
- Office Online Server: Unknown (to be confirmed; KB5002928 per Microsoft)
Microsoft released the fixes with the October 13, 2026 security updates.
Workaround
Unknown. No vendor workaround has been found; Microsoft provides a patch. As general practice, keep Protected View and Office macro restrictions enabled and block or sandbox Office files from untrusted sources.
Exploitation
- Microsoft exploit code maturity: Unproven (E:U)
- CISA SSVC: exploitation none, automatable no, technical impact total
- Not listed in CISA KEV according to a third-party tracker (CISA catalogue not checked directly)
- No evidence of exploitation in the wild found
- No public proof of concept found
- EPSS: unknown
Our recommendation
- Patch Microsoft 365 Apps, Office LTSC and Office for Mac clients through your regular monthly update cycle.
- Prioritise any Office Online Server instance reachable from the internet and apply KB5002928 or the vendor build.
- Check which Office versions and servers you run and whether Office Online Server is published externally.
- Keep Protected View and macro restrictions enabled and block untrusted Office attachments at the mail gateway.
- Monitor for unusual Excel processes or outbound connections on endpoints.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office Excel
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002928
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-97738 msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- Release notes for Office for Mac learn.microsoft.com
- Microsoft Office Online Server hotfix KB5002928 support.microsoft.com
- CVE record copy (Vulners) vulners.com
- CISA SSVC data via OpenCVE app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:46.
Original description (NVD)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.