CVE-2026-97775: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97775) involves a use-after-free condition in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw to execute arbitrary code remotely without privileges, requiring user interaction. The vulnerability affects multiple specific versions of Microsoft 365 Apps for Enterprise as listed. Microsoft has published an official fix and manages remediation for its cloud service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. No active exploitation in the wild has been reported.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97775. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional action is required beyond applying the official fix.