CVE-2026-97011: CWE-908: Use of Uninitialized Resource in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97011) is classified under CWE-908 (Use of Uninitialized Resource) and affects Microsoft Office Excel within Microsoft 365 Apps for Enterprise. The flaw allows remote code execution by leveraging an uninitialized resource, potentially enabling an attacker to execute arbitrary code over a network without privileges. The CVSS v3.1 base score is 8.8, indicating high severity. Microsoft has published an official fix and manages remediation for this cloud service. The affected versions include multiple specific builds of Microsoft 365 Apps for Enterprise as listed.

Successful exploitation could lead to remote code execution with high impact on confidentiality, integrity, and availability. An attacker could run arbitrary code remotely without prior authentication, potentially compromising affected systems. However, no active exploitation in the wild has been reported.

An official fix is available from Microsoft, and remediation is managed by the vendor for this cloud-hosted service. Users should apply the latest updates as directed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97011 to mitigate this vulnerability.