CVE-2026-97014: Microsoft 365 Apps Information Disclosure

CVE-2026-97014 Overview

CVE-2026-97014 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. An unauthorized attacker can disclose information locally by convincing a user to open a crafted Excel file. The flaw affects Microsoft 365 Apps (x64 and x86), Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exploitation requires user interaction and local access, which limits remote exposure but still presents risk through phishing and document-based delivery.

Critical Impact
Successful exploitation leaks memory contents from the Excel process, which can expose sensitive document data or memory values usable to bypass mitigations such as address space layout randomization (ASLR).

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office LTSC 2021 (x64 and x86)
Microsoft Office LTSC 2024 (x64 and x86)

Discovery Timeline

2026-10-13 - CVE-2026-97014 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-97014

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Office Excel's file parsing logic. When Excel processes a specially crafted workbook, it reads memory beyond the bounds of an allocated buffer. The content of this adjacent memory is then processed by the application, which can expose data from the Excel process address space.

The issue is scoped to confidentiality. There is no integrity or availability impact, and no privileges are required beyond opening the malicious document. User interaction is required, so the typical delivery path is a phishing email with an attached workbook or a link to a hosted file.

Root Cause

The root cause is missing or incorrect boundary checks when Excel parses structured workbook data. The parser accesses memory outside the intended object or record boundary, returning uninitialized or adjacent heap contents to downstream processing. Microsoft has not published the specific record type or parser function at fault.

Attack Vector

An attacker crafts a malicious Excel workbook and delivers it to a target through email, a file share, or a web download. When the user opens the file, Excel parses the crafted structure and triggers the out-of-bounds read. Leaked memory can be exfiltrated through document features, embedded objects, or follow-on scripting. The vulnerability is useful as part of a chain, for example to bypass ASLR before exploiting a separate memory corruption flaw.

No public proof-of-concept or exploit code is available at the time of publication. See the Microsoft Security Update Guide CVE-2026-97014 advisory for vendor technical details.

Detection Methods for CVE-2026-97014

Indicators of Compromise

Inbound email with Excel attachments (.xls, .xlsx, .xlsm, .xlsb) from untrusted senders, particularly with macro or external content prompts.
Excel process (EXCEL.EXE) spawning unexpected child processes such as powershell.exe, wscript.exe, or cmd.exe shortly after document open.
Unusual outbound network connections initiated by EXCEL.EXE to attacker-controlled infrastructure.
Crash or Watson error reports originating from Excel parser components after opening a specific workbook.

Detection Strategies

Hunt for process telemetry where EXCEL.EXE reads unusual file paths, loads unexpected DLLs, or exhibits anomalous memory access patterns.
Correlate email gateway data with endpoint telemetry to identify users who opened suspicious workbooks delivered externally.
Use YARA or document scanners to flag Excel files containing malformed records or oversized structures consistent with parser abuse.

Monitoring Recommendations

Monitor Office telemetry for repeated Excel crashes, which may indicate exploitation attempts or research activity.
Alert on Excel-initiated child processes and script interpreter execution using endpoint detection and response (EDR) rules.
Track versions of Microsoft 365 Apps and Office LTSC across the fleet to confirm patch coverage against CVE-2026-97014.

How to Mitigate CVE-2026-97014

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-97014 advisory to all affected Office installations.
Prioritize patching for users who routinely open externally sourced Excel documents, such as finance, HR, and procurement staff.
Enforce Protected View and Block Macros from the Internet policies for Office applications.

Patch Information

Microsoft has published the fix through the Security Update Guide entry for CVE-2026-97014. Microsoft 365 Apps updates are delivered through the Click-to-Run service, and Office LTSC 2021 and 2024 receive updates through Microsoft Update, WSUS, or the Microsoft Update Catalog. Verify the installed build after deployment to confirm remediation.

Workarounds

Enable Protected View for files originating from the internet, email attachments, and unsafe locations to open workbooks in a sandboxed state.
Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and injecting into other processes.
Deploy File Block policy to restrict legacy Excel binary formats where feasible.
Train users to avoid opening unsolicited Excel attachments and to report suspicious documents.

bash

# Example: enable ASR rule blocking Office child process creation (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled