CVE-2026-97746: CWE-191: Integer Underflow (Wrap or Wraparound) in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-97746 is an integer underflow (wrap or wraparound) vulnerability classified under CWE-191 affecting Microsoft Office Excel in Microsoft 365 Apps for Enterprise. This vulnerability enables an unauthorized attacker to execute arbitrary code remotely over a network. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service. The affected versions include =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, =16.0.0, and >=16.0.0.0 <16.0.10417.20228.

Successful exploitation of this vulnerability allows an unauthorized attacker to execute arbitrary code remotely on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full compromise of the affected system. The impact includes complete loss of confidentiality, integrity, and availability of the targeted system. No known exploits are currently reported in the wild.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided patches as soon as possible. Since this is a cloud-hosted service, Microsoft manages remediation server-side; customers should verify that their Microsoft 365 Apps for Enterprise installations are updated to fixed versions as per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97746.