CVE-2026-97007: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-97007 Overview

CVE-2026-97007 is a heap-based buffer overflow vulnerability [CWE-122] in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects multiple Microsoft Office products, including Microsoft 365 Apps, Microsoft 365 for macOS, Office 2021, Office 2024, and Office Online Server. Exploitation requires user interaction, typically by opening a crafted Excel document delivered through email, web download, or shared storage. Successful exploitation grants the attacker full confidentiality, integrity, and availability impact in the context of the current user. Microsoft published the advisory on October 13, 2026.

Critical Impact
An unauthenticated attacker can execute arbitrary code in the context of the Excel user by delivering a malicious spreadsheet, enabling malware installation, data theft, or lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft 365 for macOS, Microsoft Office 2021 LTSC (x64, x86, macOS), Microsoft Office 2024 LTSC (x64, x86, macOS)
Microsoft Office Online Server

Discovery Timeline

2026-10-13 - Microsoft publishes security advisory for CVE-2026-97007
2026-10-13 - CVE-2026-97007 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-97007

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel's file parsing logic. Excel allocates a heap buffer sized from untrusted fields within a spreadsheet file, then writes data past the allocated bounds when parsing malformed structures. The out-of-bounds write corrupts adjacent heap metadata or object pointers, which an attacker can leverage to redirect execution flow. Because Excel runs with the privileges of the invoking user, successful exploitation yields code execution in that user context. The issue impacts both Windows and macOS Office builds, indicating the vulnerable parsing path is shared across platforms.

Root Cause

The root cause is insufficient validation of size or count fields in Excel document structures prior to copying data into a heap-allocated buffer. When the attacker-controlled length exceeds the allocation, the write operation corrupts adjacent heap regions. Microsoft has not disclosed the specific parser component in the public advisory.

Attack Vector

The attack vector is network-based with required user interaction. An attacker crafts a malicious Excel document and delivers it through phishing email, a web link, a cloud share, or a collaboration platform. When the victim opens the file in a vulnerable Excel build, the parser triggers the heap overflow and the attacker's payload executes. Preview panes and Office Online Server rendering paths expand the exposure beyond manual file opening.

No public proof-of-concept exploit is currently listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog at publication time. Refer to the Microsoft Security Update CVE-2026-97007 advisory for the authoritative technical description.

Detection Methods for CVE-2026-97007

Indicators of Compromise

Excel process (EXCEL.EXE on Windows, Microsoft Excel on macOS) spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or shell interpreters.
Unexpected outbound network connections initiated by the Excel process shortly after opening a document.
Crash events or Windows Error Reporting entries referencing Excel modules with heap corruption signatures.
Spreadsheet files received from untrusted senders containing anomalous embedded objects or oversized record structures.

Detection Strategies

Monitor for Office applications creating child processes that match living-off-the-land binaries, which is a reliable signal of Office exploitation chains.
Correlate document open events with process creation and network telemetry to surface post-exploitation activity within seconds of file access.
Deploy YARA or content inspection on mail and web gateways to flag Excel documents with malformed BIFF or OOXML structures.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from spawning child processes and from injecting code into other processes.
Collect endpoint process, file, and network telemetry into a centralized data lake and alert on Office-initiated anomalies.
Track Excel crash events and WER submissions across the fleet to identify opportunistic or targeted exploitation attempts.

How to Mitigate CVE-2026-97007

Immediate Actions Required

Apply the October 2026 Microsoft security updates to all affected Office builds, prioritizing internet-facing users and high-value accounts.
Enforce Protected View and Office macro restrictions for files originating from the internet or email attachments.
Audit Office Online Server deployments and patch them immediately, since server-side rendering of untrusted documents expands the attack surface.
Reinforce phishing awareness and warn users about unexpected spreadsheet attachments.

Patch Information

Microsoft released patches concurrent with the advisory. Consult the Microsoft Security Update CVE-2026-97007 page for the specific build numbers for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2021 LTSC, Office 2024 LTSC, and Office Online Server. Microsoft 365 Apps on supported update channels receive the fix automatically; confirm the installed build matches the patched version.

Workarounds

Open Excel documents from untrusted sources only in Protected View and avoid enabling editing until the file is verified.
Use Office File Block policies to restrict opening legacy Excel binary formats (.xls, .xlsb) from untrusted locations.
Disable the Outlook reading pane and web preview integrations for Excel attachments on unpatched endpoints.
Route inbound Office documents through a sandbox or detonation service before delivery to end users.

bash

# Example: Office File Block registry entries (Windows) to block legacy Excel formats from untrusted locations
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\FileBlock" /v XL97Workbooks /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\FileBlock" /v OpenInProtectedView /t REG_DWORD /d 1 /f