CVE-2026-97754: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97754) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an attacker to execute arbitrary code remotely without privileges but requires user interaction. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Multiple specific versions of the product are affected, and Microsoft has released an official fix. The vendor advisory confirms the availability of patches and that remediation is managed for the cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system. The impact includes complete loss of confidentiality, integrity, and availability of the targeted system. However, exploitation requires user interaction.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates as soon as possible. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97754 for detailed patching instructions and confirmation of remediation status.