CVE-2026-97765: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-97765 is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The vulnerability affects several versions including =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, =16.0.0, and >=16.0.0.0 <16.0.10417.20228. The CVSS 3.1 base score is 8.8, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

Successful exploitation of this heap-based buffer overflow can lead to remote code execution by an unauthorized attacker, potentially allowing full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system. Given the high CVSS score of 8.8, the impact is significant if exploited.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97765. Since this is a cloud-hosted service, Microsoft manages remediation for the cloud environment. No additional mitigation steps are indicated by the vendor advisory.