Microsoft 365 Apps: Use-after-free in Excel allows remote code execution

Summary

A use-after-free vulnerability in Microsoft Excel, part of Microsoft 365 Apps and Office, allows an unauthorized attacker to execute code over a network. The attacker needs a victim to open or interact with a crafted file, typically received by email or download. Microsoft rates the flaw as Important (CVSS 8.8); no active exploitation or public exploit code is known.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 to before the build listed at https://aka.ms/OfficeSecurityReleases
• Office 365 for Mac: 1.0.0 to before 16.114.26101123 (unconfirmed)
• Office LTSC 2021: 16.0.1 to before 16.0.14334.20974
• Office LTSC 2024: 16.0.0 to before 16.0.17932.21056 (unconfirmed)
• Office LTSC for Mac 2021: 16.0.1 to before 16.114.26101123 (unconfirmed)
• Office LTSC for Mac 2024: 16.0.0 to before 16.114.26101123 (unconfirmed)
• Office Online Server: 16.0.0.0 to before 16.0.10417.20228

Fixed in

• Office LTSC 2021: 16.0.14334.20974
• Office Online Server: 16.0.10417.20228
• Microsoft 365 Apps (Click-to-Run): check the release table at https://aka.ms/OfficeSecurityReleases; build number unknown.
• LTSC 2024 and Mac builds: not verified against Microsoft; check the vendor pages.

Workaround

• No vendor workaround known. Applying the update is the stated remedy.
• Until patched: handle Excel files from unknown senders with care and keep macros restricted. This is general good practice, not a vendor-specific workaround.

Exploitation

• No evidence of active exploitation found.
• CISA SSVC: Exploitation none; not listed in CISA KEV.
• No public proof-of-concept known; Microsoft exploitability rating: Unproven.

Our recommendation

• Deploy the October 2026 Microsoft 365 / Office security updates through your normal update channel.
• Prioritise Office Online Server if it is in use and treat it as internet-facing until proven otherwise.
• Verify the installed build numbers on the Microsoft pages before reporting compliance.
• Remind staff not to open Excel files from unknown senders and restrict macros.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-97771 msrc.microsoft.com
• Microsoft 365 Apps security updates learn.microsoft.com
• Release notes for Office for Mac learn.microsoft.com
• Microsoft Office Online Server hotfix support.microsoft.com
• OpenCVE: CVE-2026-97771 app.opencve.io
• VulDB entry 419680 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:28.