CVE-2026-97008: CWE-124: Buffer Underwrite ('Buffer Underflow') in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97008) involves a buffer underwrite (buffer underflow) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It enables an attacker to execute arbitrary code remotely without privileges, requiring user interaction. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. Multiple specific versions of Microsoft 365 Apps for Enterprise are affected. Microsoft has released an official fix and manages remediation for this cloud service.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges or user authentication. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed versions as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97008.