Microsoft Office Excel: Use-after-free leads to remote code execution

Summary

A use-after-free vulnerability (CWE-416) in Microsoft Office Excel allows remote code execution. An unauthorized attacker can run code over the network if a user opens a crafted file, for example an email attachment or a download; no authentication is required. Microsoft rates the flaw Important (CVSS 8.8, high impact on confidentiality, integrity and availability). As of the records reviewed, no active exploitation and no public proof of concept are known.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact build unknown)
• Office 365 for Mac: versions from 1.0.0 before 16.114.26101123 (sources conflict, verify on MSRC)
• Office LTSC 2021: 16.0.1 before 16.0.14334.20974
• Office LTSC 2024: 16.0.0 before 16.0.17932.21056 (not confirmed against Microsoft)
• Office LTSC for Mac 2021: 16.0.1 before 16.114.26101123
• Office LTSC for Mac 2024: 16.0.0 before 16.114.26101123
• Office Online Server: 16.0.0.0 before 16.0.10417.20228 (not confirmed against KB5002928)

Fixed in

• Microsoft 365 Apps for Enterprise: Unknown. See https://aka.ms/OfficeSecurityReleases
• Office 365 for Mac: 16.114.26101123 (to be verified)
• Office LTSC 2021: 16.0.14334.20974
• Office LTSC 2024: 16.0.17932.21056 (to be verified)
• Office LTSC for Mac 2021 and 2024: Update not immediately available at release; check MSRC
• Office Online Server: 16.0.10417.20228 (to be verified via KB5002928)

Workaround

Unknown. No vendor-documented workaround. Standard interim measures until patching is possible: block or quarantine untrusted Excel attachments at the mail gateway, keep Protected View enabled and restrict macros.

Exploitation

• Exploited in the wild: No evidence in the sources (CISA SSVC: Exploitation none, Automatable no, Technical Impact total)
• Publicly disclosed at publication: No
• Microsoft exploit code maturity: Unproven (E:U)
• The October 2026 zero-day exploited in the wild is a different bug (CVE-2026-96951, Windows)

Our recommendation

• Deploy the October 2026 Office security update through the standard monthly cycle, prioritising machines that regularly open external spreadsheets (finance, accounting, administration)
• Track Mac LTSC systems until Microsoft releases the update, and apply mitigations in the meantime
• Plan the migration of Office 2021, which receives its final security update in this cycle
• Re-check exploitation status before the next review

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-97752 msrc.microsoft.com
• Microsoft 365 Apps security updates learn.microsoft.com
• Microsoft Office Server hotfix KB5002928 support.microsoft.com
• OpenCVE: CVE-2026-97752 app.opencve.io
• Action1: Patch Tuesday October 2026 www.action1.com
• Office-Watch: October 2026 Patch Tuesday Office fixes office-watch.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:37.