CVE-2026-97772 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office installations, particularly those using Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and other affected versions.

Why it matters

CVE-2026-97772 is a high-severity vulnerability in Microsoft Office Excel that allows remote code execution. Defenders should prioritize patching vulnerable versions and assess exposure in their environment. The vulnerability has a CVSS score of 8.8 and is considered high severity.

• Potential remote code execution
• Network exposure assessment required
• Patching vulnerable versions prioritized

Technical summary

A double free vulnerability in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The vulnerability is caused by a double free error in Excel, which can be exploited remotely. Defenders should prioritize patching vulnerable Microsoft Office versions and assess exposure in their environment. The CVSS score of 8.8 indicates high severity.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office versions and assess exposure in their environment.

Recommended defensive actions

• Patch vulnerable Microsoft Office versions
• Assess exposure in the environment
• Verify inventory of Microsoft Office installations

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact. There is no evidence of public exploitation, but defenders should verify inventory of Microsoft Office installations and assess exposure. The CVE Program and NIST NVD have provided official records and vulnerability assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.