CVE-2026-97778: CWE-190: Integer Overflow or Wraparound in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-97778 is an integer overflow or wraparound vulnerability (CWE-190) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. This vulnerability enables an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Multiple specific versions of Microsoft 365 Apps for Enterprise are affected. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are currently reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Microsoft 365 Apps for Enterprise environment.

An official fix is available from Microsoft. The vendor manages remediation for this cloud-hosted service. Users and administrators should apply the official updates as provided by Microsoft via their update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97778 to mitigate this vulnerability.