Microsoft Office Excel: Heap-based buffer overflow allows remote code execution

Summary

A heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps, Office LTSC, Office for Mac and Office Online Server, allows an unauthenticated remote attacker to execute code. The attacker needs a victim to open or otherwise engage with a crafted file or content, for example via a phishing email with an Excel attachment or link. The code runs with the privileges of the Excel user; CVSS 3.1 base score is 8.8 (High). Microsoft's CISA SSVC assessment lists exploitation as none and automatable as no.

Affected

• Microsoft 365 Apps for Enterprise (32- and 64-bit): affected from 16.0.1 up to the fixed build; exact build number unknown (upper bound references https://aka.ms/OfficeSecurityReleases)
• Office 365 for Mac: affected before 16.114.26101123 (per CNA data; sources conflict)
• Office LTSC 2021: affected before 16.0.14334.20974
• Office LTSC 2024: affected before 16.0.17932.21056 (per Strix only, unverified)
• Office LTSC for Mac 2021 and 2024: affected before 16.114.26101123 (fix not yet available)
• Office Online Server: affected before 16.0.10417.20228

Fixed in

• Office LTSC 2021: 16.0.14334.20974 (per CNA data, to be confirmed on MSRC)
• Office Online Server: 16.0.10417.20228 (KB5002928)
• Microsoft 365 Apps: build number unknown
• Office LTSC 2024: 16.0.17932.21056 (per Strix only, unverified)
• Office 365 for Mac: 16.114.26101123 (sources conflict)
• Office LTSC for Mac 2021 and 2024: not yet available; Microsoft will release updates as soon as possible

Workaround

Unknown. No vendor workaround was found in the sources. For LTSC for Mac, until patches are released, restrict who can send Excel files and limit macros, Protected View and file-type handling via policy; these measures are general and not verified for this CVE.

Exploitation

• Exploited in the wild: not confirmed for this CVE
• Public proof-of-concept: none found
• CISA KEV: no listing found
• Exploit price estimate by VulDB: USD 0 to 5k (market estimate, not evidence of exploitation)

Our recommendation

• Prioritise Office Online Server if it is published externally, and patch it to 16.0.10417.20228 or later
• Deploy Microsoft 365 Apps updates through the normal update channel and verify the build number afterwards
• Patch Office LTSC 2021 and 2024 to the fixed builds once confirmed on MSRC
• For Mac LTSC installations, track the MSRC page and install the update when released
• Filter Excel attachments and links in mail gateways and train staff on phishing
• Monitor for suspicious Excel processes and verify all version data on the MSRC advisory before relying on it

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-97776 msrc.microsoft.com
• Vulners CVE record CVE-2026-97776 vulners.com
• OpenCVE: CVE-2026-97776 app.opencve.io
• Strix: CVE-2026-97776 www.strix.ai
• Microsoft Support: Office Online Server hotfix KB5002928 support.microsoft.com
• Talos: Microsoft Patch Tuesday for October 2026 blog.talosintelligence.com
• VulDB: CVE-2026-97776 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:21.