CVE-2026-97017: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-97017 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw remotely without privileges and with user interaction to execute arbitrary code. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected versions include several specific builds of Microsoft 365 Apps for Enterprise prior to the fixed versions.

Successful exploitation allows unauthorized remote code execution, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This can enable attackers to run arbitrary code in the context of the user, potentially leading to system takeover or data compromise.

An official fix is available from Microsoft. Users and administrators should apply the provided updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97017. Since this is a cloud-hosted service, Microsoft manages remediation server-side, but local client updates may also be necessary.