CVE-2026-97742: CWE-121: Stack-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97742) is a stack-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Multiple affected versions are identified, including exact versions and version ranges prior to specific builds. Microsoft has issued an official fix and manages remediation for this cloud service. No known exploits have been reported in the wild.

Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability of affected systems. The vulnerability can be triggered over a network without privileges, requiring user interaction. This could lead to full compromise of the affected Microsoft 365 Apps for Enterprise environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as per Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97742 to mitigate this vulnerability.