Microsoft Office Excel: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft Office Excel allows an unauthenticated attacker to execute code over a network (CVSS 8.8, CWE-122). User interaction is required, so the attacker needs a victim to open a crafted file, for example an email attachment or a downloaded spreadsheet. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability on the affected computer.

Affected

• Microsoft 365 Apps for Enterprise (32-bit and x64): affected below the build referenced at https://aka.ms/OfficeSecurityReleases (exact build not confirmed in the sources)
• Office 365 for Mac: affected below 16.114.26101123
• Office LTSC 2021 (32-bit and x64): affected below 16.0.14334.20974
• Office LTSC 2024: affected below 16.0.17932.21056
• Office LTSC for Mac 2021 and 2024: affected below 16.114.26101123 according to the CNA record; one secondary source lists the fixed version as unclear
• Office Online Server: affected below 16.0.10417.20228

Fixed in

• Apply the October 2026 security updates from Microsoft for all listed Office products.
• Microsoft 365 Apps for Enterprise: the fixed build is not stated in the sources; check the MSRC advisory and Office security release notes.
• Office 365 for Mac and LTSC for Mac: the sources conflict on the fixed version; verify it on the MSRC advisory.

Workaround

Unknown. No vendor workaround was found in the sources. Updating is the primary mitigation.

Exploitation

• Not confirmed as exploited in the wild for this CVE at the time of the sources.
• CISA SSVC data lists Exploitation as none and Automatable as no.
• Microsoft's temporal vector uses E:U (Unproven).
• No public proof-of-concept code was found in the sources checked; this is not a complete absence check.

Our recommendation

• Install the October 2026 Office security updates on all Microsoft 365, Office LTSC and Mac installations as a high priority.
• Check the exact fixed builds on the MSRC advisory, because some sources conflict or are incomplete.
• Treat Office Online Server as a higher priority if it is reachable from the internet.
• Warn users not to open Excel files from untrusted sources, and block or scan risky attachments at the mail gateway.
• Monitor for unusual Excel child processes and check for Microsoft updates regularly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-97780 msrc.microsoft.com
• Vulners: CVE-2026-97780 (CNA JSON mirror) vulners.com
• Strix: CVE-2026-97780 www.strix.ai
• OpenCVE: CVE-2026-97780 (CISA SSVC) app.opencve.io
• Microsoft 365 Apps security updates learn.microsoft.com
• Microsoft Office Online Server KB5002928 support.microsoft.com
• Talos: Microsoft Patch Tuesday for October 2026 blog.talosintelligence.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:17.