CVE-2026-97745: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97745) involves a use-after-free condition in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. Exploitation could allow an attacker to execute arbitrary code remotely without privileges, requiring user interaction. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation enables remote code execution by an unauthorized attacker, potentially leading to full compromise of affected systems. The vulnerability affects confidentiality, integrity, and availability of the impacted environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should verify that their Microsoft 365 Apps for Enterprise installations are updated to the fixed versions as per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97745.