CVE-2026-97752: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-97752 and classified under CWE-416 (Use After Free), affects Microsoft 365 Apps for Enterprise, specifically Microsoft Office Excel. It enables remote code execution by an unauthorized attacker due to improper handling of memory leading to use-after-free conditions. The vulnerability is exploitable over a network without requiring privileges but does require user interaction. Microsoft has published an official security update to address this issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system with high impact on confidentiality, integrity, and availability. This could lead to full system compromise if exploited.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97752. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are specified by the vendor.