Microsoft Office Excel: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps and Office LTSC and Office for Mac editions, allows code execution over a network. Exploitation requires that a user opens a malicious Excel file, for example from an email attachment or a file-sharing link. The attacker can then run code with the rights of the user. CVSS 3.1 base score is 8.8 (NVD and Microsoft).

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the build fixed in October 2026 (exact upper bound is not shown in the retrieved CVE record)
• Office LTSC 2021: 16.0.1 to before 16.0.14334.20974
• Office LTSC 2024: 16.0.0 to before 16.0.17932.21056
• Office 365 for Mac and Office LTSC for Mac 2021/2024: before 16.114.26101123 (LTSC for Mac 2021 from 16.0.1, LTSC for Mac 2024 from 16.0.0)
• Office Online Server: 16.0.0.0 to before 16.0.10417.20228

Fixed in

• Fixed in the Microsoft security updates of October 13, 2026 (Windows and Office) and October 14, 2026 (Mac)
• First fixed builds per the CVE record: Office LTSC 2021 16.0.14334.20974; Office LTSC 2024 16.0.17932.21056; Office for Mac 16.114.26101123; Office Online Server 16.0.10417.20228 (KB5002928)
• Microsoft 365 Apps build: see the MSRC advisory

Workaround

Unknown. No CVE-specific workaround is published. Apply the security update.

Exploitation

• CISA SSVC: exploitation none, not automatable
• Not listed in the CISA KEV catalog at the time of research
• No public proof of concept found
• Not confirmed as exploited in the wild

Our recommendation

• Install the October 2026 Office security updates on all Microsoft 365, LTSC, Mac and Office Online Server installations
• Verify the installed build on each endpoint, because automatic updates may be delayed or blocked
• Prioritise users who regularly open external spreadsheets
• Keep Protected View enabled for files from the internet and email, and restrict macros and active content
• Recheck the MSRC advisory and CISA KEV before closing the ticket

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-97757 msrc.microsoft.com
• Microsoft Office security update release notes learn.microsoft.com
• Microsoft Office for Mac release notes learn.microsoft.com
• Office Online Server KB5002928 support.microsoft.com
• OpenCVE (NVD and CISA ADP data) app.opencve.io
• Action1 October 2026 Patch Tuesday www.action1.com
• Talos October 2026 Patch Tuesday blog.talosintelligence.com
• VulDB (conflicting scoring) vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:31.