CVE-2026-97741: Microsoft Excel RCE Vulnerability

CVE-2026-97741 Overview

CVE-2026-97741 is a heap-based buffer overflow vulnerability [CWE-122] in Microsoft Office Excel. The flaw allows an unauthorized attacker to execute arbitrary code over a network when a user opens a crafted Excel file. Microsoft published the advisory on October 13, 2026.

The vulnerability carries a CVSS 3.1 base score of 8.8. Exploitation requires user interaction, typically opening a malicious workbook delivered via email, web download, or shared storage. Successful exploitation yields code execution in the context of the current user, enabling data theft, lateral movement, or persistence.

Critical Impact

An attacker who convinces a user to open a crafted Excel document can execute arbitrary code on the target host with the privileges of the logged-on user.

Affected Products

• Microsoft Office Excel (see the Microsoft CVE-2026-97741 Update Guide for the authoritative list of affected builds)

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-97741 published to NVD
• 2026-10-13 - Microsoft released the security advisory via the Update Guide
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97741

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Office Excel's parsing logic. When Excel processes a malformed spreadsheet structure, the application writes data beyond the bounds of a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap metadata and application objects.

An attacker crafts an Excel file containing malformed records or oversized fields that trigger the overflow during document load. Because the corruption occurs on the heap, exploitation typically relies on controlled object placement to overwrite function pointers or virtual table entries. Successful exploitation redirects execution to attacker-controlled code.

The EPSS score at publication is approximately 0.80%, indicating moderate near-term exploitation probability for an Office RCE class issue.

Root Cause

The root cause is improper validation of record size or field length values during deserialization of Excel file content. The parser trusts attacker-supplied length fields and allocates or writes based on those values without enforcing the actual destination buffer size, producing the heap overflow condition described by [CWE-122].

Attack Vector

The attack vector is network-based with required user interaction. Delivery mechanisms include phishing emails with Excel attachments, documents hosted on compromised or attacker-controlled web pages, and files shared through collaboration platforms. The Preview Pane may also act as an attack trigger for certain Office vulnerabilities, which increases exposure for users who view documents without explicitly opening them.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not currently in the CISA Known Exploited Vulnerabilities catalog.

See the Microsoft CVE-2026-97741 Update Guide for additional technical details.

Detection Methods for CVE-2026-97741

Indicators of Compromise

• Unexpected child processes spawned by EXCEL.EXE, especially cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
• Excel process crashes or Windows Error Reporting events referencing heap corruption in EXCEL.EXE or related Office DLLs.
• Office processes making outbound network connections to uncategorized or newly registered domains shortly after a document is opened.
• Creation of executables, scripts, or scheduled tasks in user-writable paths following an Excel session.

Detection Strategies

• Hunt for anomalous process lineage where EXCEL.EXE is the parent of script interpreters or living-off-the-land binaries.
• Enable and monitor Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes.
• Inspect inbound email attachments and web downloads for Excel files with malformed BIFF or OOXML records using sandbox detonation.
• Correlate Office crash telemetry with subsequent suspicious user or network activity on the same host.

Monitoring Recommendations

• Collect endpoint process creation, file write, and network connection events with Office processes as the subject.
• Centralize Windows Event Logs, Sysmon, and EDR telemetry in a SIEM for cross-source correlation and retrospective hunting.
• Alert on Excel loading unusual DLLs from user-writable directories or temp paths.
• Track patch deployment status for Microsoft Office across the fleet to identify unpatched endpoints.

How to Mitigate CVE-2026-97741

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft CVE-2026-97741 Update Guide to all affected Office installations.
• Prioritize patching for users who routinely process external Excel documents, such as finance, procurement, and executive assistants.
• Reinforce user guidance on opening Excel attachments from untrusted senders and enable Protected View enforcement.
• Validate that endpoint protection and email filtering are current and able to detonate Office attachments.

Patch Information

Microsoft released a security update for CVE-2026-97741 on October 13, 2026. Refer to the Microsoft CVE-2026-97741 Update Guide for the authoritative list of affected products, build numbers, and KB articles. Deploy updates through Windows Update, Microsoft Update, Microsoft 365 Apps update channels, or your enterprise patch management platform.

Workarounds

• Enforce Protected View and Office Application Guard for files originating from the internet and email.
• Block Office applications from spawning child processes using Microsoft Defender ASR rules.
• Disable the Outlook Preview Pane for high-risk user groups until patching completes.
• Restrict macro execution and apply Office Trusted Locations policies to limit the attack surface.

# Enable the ASR rule that blocks Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify the rule is active
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids