CVE-2026-97758: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97758) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an attacker without privileges to execute arbitrary code remotely by exploiting the flaw over a network. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official security update to address this vulnerability. The affected versions include multiple specific builds of Microsoft 365 Apps for Enterprise prior to the fixed versions.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely without requiring privileges, potentially leading to full compromise of the affected system. The impact includes complete loss of confidentiality, integrity, and availability of the affected application and potentially the host system.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as soon as possible. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97758 for detailed patching instructions.