CVE-2026-97747: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-97747 and categorized under CWE-416 (Use After Free), affects Microsoft Office Excel in Microsoft 365 Apps for Enterprise. It allows remote code execution by an unauthorized attacker due to improper handling of memory, specifically a use-after-free condition. The CVSS 3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. The vendor has released an official patch to address this issue. The vulnerability affects multiple specific versions of Microsoft 365 Apps for Enterprise, primarily around version 16.0. The vendor advisory is available at Microsoft's security update guide.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system running Microsoft 365 Apps for Enterprise Excel. No active exploitation in the wild has been reported.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as soon as possible to remediate this vulnerability. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft security update guide for detailed patch information and deployment instructions.