CVE-2026-97009 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office installations, particularly those using Excel, should assess exposure and prioritize patching. This includes administrators and security teams managing Microsoft Office deployments, as well as operators and platform owners who need to ensure the security of their systems. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft 5

Why it matters

CVE-2026-97009 is a high-severity vulnerability in Microsoft Office Excel that allows remote code execution. Defenders should prioritize patching, assess exposure, and monitor for suspicious activity.

• Potential remote code execution requires immediate patching priority
• Exposure assessment and inventory checks are necessary for Microsoft Office deployments
• Monitoring for suspicious Excel activity can help detect potential exploitation attempts

Technical summary

A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. This issue is a high-severity vulnerability that requires immediate patching priority. Defenders should assess exposure and monitor for suspicious activity. The vulnerability is a result of a buffer overflow in the Excel software, which can be exploited by attackers to execute malicious code.

Defensive priority

High

Recommended defensive actions

• Review and apply the Microsoft patch for CVE-2026-97009
• Inventory Microsoft Office installations for potential exposure
• Monitor Excel usage for suspicious activity

Evidence notes

The CVE record and source item provide details on a heap-based buffer overflow in Microsoft Office Excel, allowing an unauthorized attacker to execute code locally. The affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.