CVE-2026-97762: CWE-787: Out-of-bounds Write in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-97762 and classified under CWE-787 (Out-of-bounds Write), affects Microsoft Office Excel in Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute arbitrary code remotely by exploiting an out-of-bounds write condition. The CVSS 3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected versions include multiple specific builds of Microsoft 365 Apps for Enterprise as detailed in the affectedVersions field.

Successful exploitation could allow an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could enable unauthorized control over the affected Microsoft 365 Apps for Enterprise environment.

An official fix is available from Microsoft. Users and administrators should apply the provided updates as per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97762. Since this is a cloud-hosted service, Microsoft manages remediation server-side, but customers should verify that their environments are updated accordingly.