CVE-2026-97746: Microsoft Excel Integer Underflow RCE Flaw

CVE-2026-97746 Overview

CVE-2026-97746 is an integer underflow vulnerability in Microsoft Office Excel that allows an unauthenticated attacker to execute arbitrary code over a network. The flaw is tracked under CWE-191: Integer Underflow (Wrap or Wraparound) and requires user interaction to trigger, typically through opening a crafted Excel document. Successful exploitation yields high impact on confidentiality, integrity, and availability on the targeted host. Microsoft published the advisory on October 13, 2026, through the Microsoft Security Response Center.

Critical Impact

An attacker who convinces a user to open a malicious Excel file can execute code in the context of the current user, enabling malware deployment, credential theft, and lateral movement.

Affected Products

• Microsoft Office Excel (specific affected versions listed in the Microsoft CVE-2026-97746 Advisory)
• Microsoft Office installations that embed the Excel component
• Microsoft 365 Apps distributions that include Excel

Discovery Timeline

• 2026-10-13 - CVE-2026-97746 published to NVD
• 2026-10-13 - Microsoft published advisory through MSRC
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97746

Vulnerability Analysis

The vulnerability stems from an integer underflow condition in Microsoft Office Excel's processing logic for crafted spreadsheet content. When Excel parses a malformed structure, an arithmetic operation subtracts a value from an unsigned integer that is smaller than the subtrahend. The result wraps to a very large positive value, bypassing size checks that gate subsequent memory operations.

Downstream code then uses the wrapped value as a length or offset, producing out-of-bounds memory access on the heap. Attackers shape adjacent heap allocations and corrupted structures to achieve control over execution flow. The outcome is arbitrary code execution in the security context of the user running Excel.

The attack vector is network-based, but exploitation requires the victim to open or preview a crafted file. Delivery typically occurs through email attachments, hosted documents, or chat-based file sharing.

Root Cause

The root cause is missing or inadequate validation of untrusted size fields before unsigned integer arithmetic, classified as CWE-191. The parser trusts attacker-controlled values and performs subtraction without checking that the minuend exceeds the subtrahend, allowing the wrap-around condition.

Attack Vector

Exploitation requires an attacker to deliver a crafted Excel document and persuade a user to open it. Protected View may limit initial impact, but a user who clicks "Enable Editing" exposes the full attack surface. Once executed, the payload runs with the privileges of the signed-in user and can download additional stages or pivot into enterprise resources.

No public proof-of-concept code is available at the time of writing. The EPSS probability for near-term exploitation is 0.738%, reflecting elevated attacker interest in Office document vulnerabilities. Refer to the Microsoft CVE-2026-97746 Advisory for parser-level technical details.

Detection Methods for CVE-2026-97746

Indicators of Compromise

• Excel spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
• Office processes writing executable files or scripts to %TEMP%, %APPDATA%, or %PUBLIC% directories.
• Outbound network connections initiated directly by excel.exe to uncategorized or newly registered domains.
• Excel documents arriving from external senders with embedded objects, macros, or unusual OLE streams.

Detection Strategies

• Alert on Excel process ancestry that terminates in script interpreters or living-off-the-land binaries.
• Hunt for heap corruption and crash telemetry originating in excel.exe with faulting modules inside Office binaries.
• Correlate inbound email attachments of type .xls, .xlsx, .xlsm, and .xlsb with subsequent endpoint execution events.

Monitoring Recommendations

• Ingest Microsoft Defender, Sysmon, and email gateway telemetry into a centralized data lake for cross-source correlation.
• Enable Attack Surface Reduction (ASR) rules that block Office child-process creation and executable content from email.
• Track patch deployment status across Office and Microsoft 365 Apps installations to identify unpatched endpoints.

How to Mitigate CVE-2026-97746

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft CVE-2026-97746 Advisory to all Excel and Office installations.
• Enforce Protected View and Office Protected View for files originating from the internet and from email attachments.
• Block or quarantine inbound Excel attachments from untrusted senders at the mail gateway pending patch rollout.
• Enable Microsoft Defender Attack Surface Reduction rules that prevent Office applications from spawning child processes.

Patch Information

Microsoft released a security update addressing CVE-2026-97746 on October 13, 2026. Deploy the update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or the Microsoft 365 Apps update channel. Confirm successful installation by validating the patched build number against the version listed in the Microsoft advisory.

Workarounds

• Keep files from the internet in Protected View and instruct users to avoid clicking "Enable Editing" on untrusted documents.
• Restrict Excel file types at the mail gateway and web proxy for high-risk user groups until patching completes.
• Deploy application control policies that prevent Office applications from launching script interpreters and unsigned binaries.

# Example: enable the ASR rule that blocks Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled