CVE-2026-97743: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97743) is a use-after-free issue in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information remotely over a network. The CVSS 3.1 base score is 6.5, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, and user interaction required. The vulnerability affects versions =16.0.0, =16.0.1, and =1.0.0 of the product. Microsoft has published an official fix for this vulnerability and manages remediation for this cloud-hosted service. There are no known exploits in the wild at this time.

An attacker can remotely cause information disclosure by exploiting the use-after-free vulnerability in Microsoft Excel. The impact is limited to confidentiality loss; integrity and availability are not affected. No known active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the provided patches as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97743. Since this is a cloud service, Microsoft manages remediation for the hosted environment. Ensure that client applications are updated to the fixed versions to prevent exploitation.