CVE-2026-97750 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office installations, particularly those using Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and various Office LTSC versions.

Why it matters

CVE-2026-97750 is a high-severity vulnerability in Microsoft Office Excel that allows remote code execution. Defenders should prioritize patching vulnerable versions and assess exposure in their environment.

• Potential remote code execution
• Network-based attack vector requires immediate patching priority
• Verify inventory and patch vulnerable versions

Technical summary

A stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. This vulnerability affects Microsoft Office installations, particularly those using Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and various Office LTSC versions. Defenders should prioritize patching vulnerable versions and assess exposure in their environment.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office versions and assess exposure in their environment.

Recommended defensive actions

• Patch vulnerable Microsoft Office versions
• Assess exposure in the environment
• Verify inventory of Microsoft Office installations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation and impact is limited. Defenders should verify inventory and patch vulnerable versions. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment. However, there is no information on known or unknown affected scope beyond the official advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.