CVE-2026-97767 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office Excel deployments should assess exposure and prioritize patching vulnerable versions. This includes operators, platforms, vulnerability management, and security teams that need to review and apply vendor-provided updates.

Why it matters

Defenders should prioritize patching vulnerable Microsoft Office Excel versions to prevent potential remote code execution. The vulnerability affects multiple Microsoft Office products and requires verification of exposure and application of vendor-provided updates.

• Potential remote code execution over a network
• Requires patching vulnerable Microsoft Office Excel versions
• Verify and apply vendor-provided updates

Technical summary

A double free vulnerability in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The vulnerability affects multiple Microsoft Office products, including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Microsoft Office LTSC 2021.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office Excel versions to prevent potential remote code execution.

Recommended defensive actions

• Patch vulnerable Microsoft Office Excel versions
• Verify and apply vendor-provided updates
• Monitor for suspicious activity in Excel

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact. The vulnerability affects multiple Microsoft Office products, including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Microsoft Office LTSC 2021. There is no information on known or unknown affected scope. Defenders should verify exposure and apply vendor-provided updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.