Microsoft Office Excel: Stack-based buffer overflow allows remote code execution

Summary

Microsoft Office Excel contains a stack-based buffer overflow (CWE-121) that allows an unauthenticated attacker to execute code over a network. Exploitation requires that a user interacts with the attack, most likely by opening a malicious spreadsheet. CVSS 3.1 rates it 8.8 (High), and CISA's SSVC data lists technical impact as total, with exploitation as none.

Affected

• Microsoft 365 Apps for Enterprise (exact version ranges: Unknown, check MSRC)
• Office LTSC 2021 and LTSC 2024 (exact version ranges: Unknown, check MSRC)
• Office for Mac 2021, Office LTSC for Mac 2024 and Microsoft 365 for Mac (exact version ranges: Unknown, check MSRC)
• Office Online Server (build 16.0.10417.20228 is the fixed build according to Microsoft's hotfix page; earlier builds are affected)

Fixed in

• Microsoft 365 Apps, Office LTSC and Office for Mac: Released in the October 2026 security updates (13 October 2026 for Windows, 14 October 2026 for Mac). Exact fixed builds: Unknown, confirm in the MSRC affected-product table.
• Office Online Server: 16.0.10417.20228

Workaround

Unknown. No workaround or mitigation is documented by the sources. Installing the security update is the fix.

Exploitation

• Not listed in CISA's KEV catalogue.
• Public proof-of-concept exploit: none found (this is not proof that none exists).
• Talos reports one vulnerability in the October 2026 release was exploited in the wild, but CVE-2026-97750 is not among the CVEs named, so this is not confirmed for this CVE.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Patch Microsoft 365 Apps, Office LTSC, Office for Mac and Office Online Server as part of the October 2026 update cycle; treat as high priority.
• Confirm the fixed builds in the MSRC update guide before relying on version numbers.
• Check whether Office Online Server is published to the internet and restrict access if possible.
• Keep Protected View enabled, be cautious with spreadsheets from unknown senders, and restrict macros (general good practice, not vendor-documented).
• Use the Microsoft 365 update channel or managed patching to verify deployment on all clients.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-97750 msrc.microsoft.com
• Microsoft 365 Apps security updates learn.microsoft.com
• Office for Mac release notes learn.microsoft.com
• Office Online Server hotfix 5002928 support.microsoft.com
• Talos: Microsoft Patch Tuesday for October 2026 blog.talosintelligence.com
• OpenCVE: CVE-2026-97750 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:36.