Microsoft Office Excel: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft Office Excel allows a remote attacker to execute code. The attacker needs no privileges, but a user must open a crafted file or link. Code execution on the user's workstation is the main risk, and the CVSS base score is 8.8 (High). Microsoft has released fixes; no exploitation in the wild is known.

Affected

• Microsoft 365 Apps for Enterprise (see the MSRC advisory for affected builds)
• Microsoft Office 365 for Mac (before 16.114.26101123)
• Microsoft Office LTSC 2021 (16.0.1 to before 16.0.14334.20974)
• Microsoft Office LTSC 2024 (16.0.0 to before 16.0.17932.21056)
• Microsoft Office LTSC for Mac 2021 (16.0.1 to before 16.114.26101123)
• Microsoft Office LTSC for Mac 2024 (16.0.0 to before 16.114.26101123)
• Microsoft Office Online Server (16.0.0.0 to before 16.0.10417.20228)

Fixed in

• Microsoft 365 Apps for Enterprise: Unknown (the CNA record refers to https://aka.ms/OfficeSecurityReleases; no build number confirmed)
• Office for Mac: 16.114.26101123 (per CVE record, verify against MSRC)
• Office LTSC 2021: 16.0.14334.20974 (per aggregator data, verify against MSRC)
• Office LTSC 2024: 16.0.17932.21056 (per aggregator data, verify against MSRC)
• Office LTSC for Mac 2021 and 2024: 16.114.26101123 (per CVE record, verify against MSRC)
• Office Online Server: 16.0.10417.20228 (per aggregator data, security update KB5002928, verify against MSRC)

Workaround

Unknown.

• No vendor workaround was confirmed in the sources; check the MSRC advisory directly.
• Until patched, keep Protected View enabled for files from the internet or email and restrict risky attachment types through policy (general hardening, not vendor guidance).

Exploitation

• No exploitation in the wild is known from the sources.
• Not listed in the CISA KEV catalog; EPSS is below 1%.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof-of-concept found; Microsoft marks exploit maturity as Unproven.
• Heap overflows in Office are often reverse-engineered after patch release, so prompt patching matters.

Our recommendation

• Patch Microsoft 365 Apps, Office LTSC and Office Online Server (if deployed) through the normal update channel, using the build numbers on the MSRC page.
• Check whether Office Online Server is in use; it is rare in SMEs.
• Remind users not to open unexpected Excel files or links from untrusted sources.
• Monitor KEV and public proof-of-concept reports for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-97769 msrc.microsoft.com
• Microsoft 365 Apps security updates learn.microsoft.com
• Release notes for Office for Mac learn.microsoft.com
• Office Online Server security update KB5002928 support.microsoft.com
• CVE record aggregator (Vulners) vulners.com
• OpenCVE entry (CVE-2026-97769) app.opencve.io
• VulDB entry 419725 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:26.