CVE-2026-97739: Microsoft Excel RCE Vulnerability

CVE-2026-97739 Overview

CVE-2026-97739 is an integer underflow vulnerability in Microsoft Office Excel that allows unauthenticated attackers to execute arbitrary code over a network. The flaw stems from improper handling of numeric values that wrap around below zero, corrupting heap memory during spreadsheet parsing [CWE-122]. An attacker crafts a malicious Excel file and delivers it through email, web download, or shared storage. When a target opens the file, the underflow condition triggers memory corruption that leads to code execution in the user's security context.

Critical Impact

Successful exploitation grants attackers the ability to execute arbitrary code, install malware, modify data, or create new accounts with the privileges of the logged-on user.

Affected Products

• Microsoft Office Excel (specific versions listed in the Microsoft Security Response Center advisory)
• Microsoft 365 Apps deployments including Excel
• Microsoft Office installations processing untrusted spreadsheet files

Discovery Timeline

• 2026-10-13 - CVE-2026-97739 published to the National Vulnerability Database
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97739

Vulnerability Analysis

The vulnerability is classified as a heap-based buffer overflow caused by an integer underflow [CWE-122]. Excel performs arithmetic on an unsigned value derived from attacker-controlled fields inside a crafted workbook. When the computation produces a value below zero, the result wraps to a large positive integer. Excel then uses this corrupted size value to allocate or index into a heap buffer, enabling out-of-bounds writes.

The attack requires user interaction, meaning a victim must open the malicious file. Once opened, the memory corruption primitive can be shaped to overwrite function pointers or virtual method tables, redirecting execution to attacker-supplied shellcode. The exploit executes under the privileges of the current user, which is sufficient to establish persistence or deploy follow-on payloads.

Root Cause

The root cause is missing validation of signed-to-unsigned conversions during Excel's file parsing routines. When a malformed structure specifies a length or offset that produces a negative intermediate value, the subsequent cast yields a very large allocation or write length. This mismatch between declared and actual buffer sizes produces the heap corruption condition.

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts or emails a weaponized .xlsx, .xls, or related Excel document. Opening the file in a vulnerable Excel build triggers the parser path that performs the flawed arithmetic. The Preview Pane in Windows Explorer and Outlook can also trigger file parsing, expanding the attack surface beyond explicit user double-clicks.

No verified public exploit code is available. Technical details are documented in the Microsoft Security Update CVE-2026-97739 advisory.

Detection Methods for CVE-2026-97739

Indicators of Compromise

• Unexpected child processes spawned by EXCEL.EXE, particularly cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
• Excel process crashes or Windows Error Reporting entries referencing access violations shortly after opening a spreadsheet
• Outbound network connections initiated by EXCEL.EXE to untrusted or newly registered domains
• Creation of executable files or scheduled tasks following interaction with an Excel attachment

Detection Strategies

• Monitor Office telemetry for anomalous process trees originating from Excel using Sysmon Event ID 1 or EDR process-creation events
• Flag Excel documents arriving from external email with macros, embedded objects, or unusually malformed structures
• Correlate Excel crashes with subsequent file writes to %TEMP%, %APPDATA%, or startup folders

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes
• Collect and retain Office application logs, Windows Defender exploit guard events, and endpoint EDR telemetry centrally
• Alert on exploitation patterns consistent with heap corruption, including shellcode-like memory regions in EXCEL.EXE

How to Mitigate CVE-2026-97739

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-97739 across all Excel installations
• Prioritize patching for users who routinely open spreadsheets from external sources
• Validate patch deployment through Microsoft Update, WSUS, or Intune compliance reports

Patch Information

Microsoft has published a security update addressing CVE-2026-97739. Administrators should consult the Microsoft Security Update CVE-2026-97739 guide for the applicable KB articles, affected build numbers, and deployment channels for Microsoft 365 Apps, Office LTSC, and standalone Office versions.

Workarounds

• Disable the Preview Pane and Reading Pane in Outlook and Windows Explorer to prevent automatic file parsing
• Enforce Protected View and Office File Block policies to open files from the internet in a sandboxed read-only mode
• Train users to avoid opening unsolicited Excel attachments and route suspicious files through a sandbox analysis workflow

# Enforce Protected View for files originating from the internet (per-user registry setting)
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f