CVE-2026-97763: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97763) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code remotely over a network. The CVSS v3.1 base score is 8.8, indicating high severity, with attack vector network, low attack complexity, no privileges required, but user interaction is needed. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise, including =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, =16.0.0, and >=16.0.0.0 <16.0.10417.20228. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation of this heap-based buffer overflow can lead to remote code execution with high impact on confidentiality, integrity, and availability. An attacker can run arbitrary code on the affected system remotely, potentially leading to full system compromise. The vulnerability requires user interaction but no privileges or authentication.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97763. Because this is a cloud-hosted service, Microsoft manages remediation server-side. No additional action is required beyond applying the official fix.