CVE-2026-97755: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97755) is an out-of-bounds read issue in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code remotely over a network. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected versions include multiple specific builds of Microsoft 365 Apps for Enterprise as listed.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This can result in unauthorized access, data manipulation, or service disruption within Microsoft 365 Apps for Enterprise environments.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed versions as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97755. No additional mitigation actions are required beyond applying the official update.