Office Excel: Remote code execution via use-after-free

Summary

Microsoft Office Excel contains a use-after-free memory corruption flaw (CWE-416) that allows an unauthorized attacker to execute code over the network. The CVSS 3.1 base score is 8.8 (HIGH). Exploitation requires user interaction, most likely opening a crafted Excel file received by email or download. CISA SSVC data rates exploitation as none and automation as not possible, and no public proof of concept was found in the research.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build listed in the Microsoft Security Update Guide (exact build unknown)
• Microsoft Office 365 for Mac: 1.0.0 to before 16.114.26101123
• Microsoft Office LTSC 2021: 16.0.1 to before 16.0.14334.20974
• Microsoft Office LTSC 2024: 16.0.0 to before 16.0.17932.21056
• Microsoft Office LTSC for Mac 2021: 16.0.1 to before 16.114.26101123
• Microsoft Office LTSC for Mac 2024: 16.0.0 to before 16.114.26101123
• Office Online Server: 16.0.0.0 to before 16.0.10417.20228

Fixed in

• Security update from October 13, 2026 (Office/Excel)
• Office Online Server: build 16.0.10417.20228 or later (Microsoft KB5002928)
• Other products: confirm the fixed build in the MSRC Security Update Guide, as the listed ranges have not been independently verified

Workaround

Unknown. No workaround was found in the available sources. Where patching is delayed, restrict opening Office files from untrusted email or downloads and keep Protected View enabled.

Exploitation

• Not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog
• CISA SSVC (Vulnrichment): Exploitation none, Automatable no, Technical Impact total
• No public proof of concept found; this does not prove that none exists
• Not to be confused with the exploited Windows Shell zero-day CVE-2026-96951 from the same update

Our recommendation

• Patch Microsoft Office Excel and Office Online Server (if used) in this patch cycle as high priority
• Confirm the installed build on each client and server against the MSRC Security Update Guide
• Check whether any on-premises Office Online Server is reachable from the internet
• Remind users not to open Excel files from unknown senders or untrusted sources
• Monitor for changes in KEV status or public exploit reports

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-97775 msrc.microsoft.com
• OpenCVE: CVE-2026-97775 app.opencve.io
• Microsoft KB5002928: Office Online Server hotfix support.microsoft.com
• Microsoft 365 Apps security updates learn.microsoft.com
• Office for Mac release notes learn.microsoft.com
• Vulners: CVE-2026-97775 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:21.