CVE-2026-97776: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97776) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code remotely by exploiting the flaw over a network. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official security update to address this vulnerability and manages remediation for this cloud-hosted service. No active exploitation has been reported.

Successful exploitation allows remote code execution without privileges, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system running Microsoft 365 Apps for Enterprise Excel component.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97776. Since this is a cloud service, Microsoft manages remediation server-side, but clients should ensure their software is updated to the fixed versions.