CVE-2026-97004: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-97004 Overview

CVE-2026-97004 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel that allows an unauthenticated attacker to execute arbitrary code on a victim system. Exploitation requires the target user to open or preview a crafted Excel document delivered over a network. Successful exploitation yields code execution in the context of the current user, which attackers can use for persistence, credential theft, or lateral movement across an enterprise environment.

The flaw affects multiple current Office product lines on Windows and macOS, including Microsoft 365 Apps, Office 2021, Office 2024, and Office Online Server. Microsoft published the advisory on October 13, 2026.

Critical Impact
A single malicious spreadsheet opened by any user can trigger heap corruption and remote code execution across both Windows and macOS Office deployments.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office LTSC 2021 and Office LTSC 2024 (Windows x64/x86 and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-10-13 - CVE-2026-97004 published to NVD and Microsoft Security Response Center advisory released
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-97004

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Excel document parser. When Excel processes a specially crafted spreadsheet, it writes data past the bounds of a heap-allocated buffer. The resulting corruption of adjacent heap metadata or object pointers enables an attacker to redirect execution flow.

Because the attack vector is network-based and no privileges are required, delivery typically occurs through email attachments, SharePoint links, or malicious web downloads. User interaction is required: the victim must open the document in a vulnerable Excel build. Successful exploitation grants code execution at the privilege level of the user running Excel.

Root Cause

The root cause is improper validation of record sizes or field lengths during parsing of a structure embedded in an Excel file. Excel allocates a heap buffer sized according to one field while copying data governed by another, producing an out-of-bounds write classified as [CWE-122]. Attackers who control the overflow payload can corrupt C++ virtual function table pointers or heap chunk metadata to achieve arbitrary code execution.

Attack Vector

An attacker crafts a malicious .xlsx, .xls, or related Excel format and delivers it through phishing, a watering-hole site, or a shared document platform. When the user opens the file, Excel parses the embedded structures and triggers the overflow. The Preview Pane in Outlook or Explorer may also be sufficient to trigger parsing in some configurations. Office Online Server is also affected, meaning server-side rendering of attacker-supplied documents can expose the hosting infrastructure.

No verified public exploit code is available at this time. See the Microsoft CVE-2026-97004 Update Guide for technical details.

Detection Methods for CVE-2026-97004

Indicators of Compromise

Unexpected child processes spawned from EXCEL.EXE, such as cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript.exe.
Excel process crashes or faulting modules referencing Excel parsing DLLs, which may indicate failed exploitation attempts.
Outbound network connections initiated by EXCEL.EXE to unfamiliar domains or IP addresses shortly after document open events.
New files written to %APPDATA%, %LOCALAPPDATA%, or Office startup folders following opening of an inbound spreadsheet.

Detection Strategies

Hunt for Excel spawning scripting or living-off-the-land binaries, mapped to MITRE ATT&CK T1203 (Exploitation for Client Execution) and T1566.001 (Spearphishing Attachment).
Monitor Office telemetry for .xlsx and .xls files opened from internet-zone or email-attachment paths followed by anomalous process or network activity.
Correlate email gateway logs with endpoint document-open events to flag user-cohort patterns consistent with a phishing campaign.

Monitoring Recommendations

Enable and forward Microsoft Office audit logs and Windows Sysmon events (Process Create, Image Load, Network Connect) to a centralized SIEM.
Alert on first-seen attachment hashes delivered to multiple recipients and opened within a short window.
Track Office Online Server request logs for anomalous document uploads and rendering errors.

How to Mitigate CVE-2026-97004

Immediate Actions Required

Apply the Microsoft security updates for all affected Office channels on Windows and macOS, and update Office Online Server instances.
Prioritize patching for users with high-value access such as administrators, finance, and executives who frequently receive external spreadsheets.
Block or quarantine inbound Excel attachments at the email gateway pending patch deployment across the fleet.

Patch Information

Microsoft released fixes referenced in the Microsoft CVE-2026-97004 Update Guide. Administrators should verify Click-to-Run and MSI builds on Windows endpoints and ensure the macOS AutoUpdate channel has deployed the current Microsoft 365 build. Office Online Server requires a separate server-side update.

Workarounds

Enforce Protected View and Office Trust Center policies to open internet-sourced documents in a sandboxed state.
Disable the Outlook and File Explorer Preview Pane for Excel formats to prevent automatic parsing of untrusted content.
Enable Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Restrict macro execution and file opening to signed or trusted-location documents using group policy.

bash

# Example: enable ASR rule blocking Office apps from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Example: disable Outlook Preview Pane auto-rendering via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Outlook\Options\Mail" /v DisableReadingPaneAutoPreview /t REG_DWORD /d 1 /f