CVE-2026-97759: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-97759 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables an attacker to execute arbitrary code remotely by exploiting memory corruption caused by use-after-free conditions. The vulnerability has a CVSS v3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Affected versions include =16.0.1, =1.0.0, >=16.0.0 <16.0.17932.21056, and =16.0.0. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability of the affected system. This could enable an attacker to run arbitrary code in the context of the user, potentially leading to full system compromise.

An official fix is available from Microsoft. Users and administrators should apply the provided updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97759. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation steps are required beyond applying the official fix.