CVE-2026-97773: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-97773 is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw enables remote code execution by an unauthorized attacker over a network. The vulnerability has been assigned a CVSS v3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has published an official security update to remediate this vulnerability. The affected versions include multiple specific builds of Microsoft 365 Apps for Enterprise, ranging from version 1.0.0 and various 16.0.x builds prior to fixed versions.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the impacted environment. The vulnerability requires user interaction but no prior privileges, making it a significant risk in networked environments where malicious Excel files can be delivered.

Microsoft has released an official fix for CVE-2026-97773. It is strongly recommended to apply the security updates provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97773. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Users should ensure their Microsoft 365 Apps for Enterprise installations are updated to versions beyond the affected builds.