CVE-2026-97007: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97007) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. The vendor has issued an official fix, and the vulnerability affects multiple versions of the product prior to the fixed releases.

Successful exploitation allows an attacker to execute arbitrary code remotely without privileges, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. No active exploitation has been reported yet.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided patches promptly. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97007 for detailed patching instructions.