CVE-2026-97739: CWE-191: Integer Underflow (Wrap or Wraparound) in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-97739, involves an integer underflow (wrap or wraparound) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw enables remote code execution by an unauthorized attacker over a network. The CVSS v3.1 base score is 8.8, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Multiple affected versions are explicitly stated, and Microsoft has issued an official fix. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97739. The service is cloud-hosted, and Microsoft manages remediation server-side.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system or data.

An official fix is available from Microsoft. Microsoft manages remediation for this cloud-hosted service, so users should ensure their Microsoft 365 Apps for Enterprise installations are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97739. No additional mitigation actions are specified by the vendor.