CVE-2026-97771 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office products, particularly those using Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and various Office LTSC versions.

Why it matters

CVE-2026-97771 is a high-severity vulnerability in Microsoft Office Excel that allows remote code execution. Defenders should prioritize patching vulnerable Office versions and assess exposure across various Office products.

• Potential remote code execution over a network
• Requires patching of vulnerable Office versions to prevent exploitation
• Defenders should verify inventory of Office products and prioritize patching
• Exposure assessment is necessary for various Office products

Technical summary

A use-after-free vulnerability in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. This vulnerability is caused by a use-after-free error in the Excel software, which can be exploited by an attacker to execute arbitrary code. The vulnerability affects various Office products, including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and various Office LTSC versions.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office versions and assess exposure across various Office products.

Recommended defensive actions

• Patch vulnerable Microsoft Office versions
• Assess exposure across various Office products
• Verify inventory of Office products and prioritize patching
• Monitor for potential exploitation attempts

Evidence notes

The CVE record and source item provide details on the vulnerability, affected products, and vendor advisory. The vulnerability has a high-severity CVSS score of 8.8 and is classified as a use-after-free vulnerability in Microsoft Office Excel. Defenders should verify inventory of Office products and prioritize patching. The source item provides additional information on the vulnerability and affected products.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.