CVE-2026-97755 Overview
CVE-2026-97755 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthenticated attacker to execute arbitrary code over a network. The flaw is classified under [CWE-125] (Out-of-bounds Read) and requires user interaction, typically by opening a crafted Excel document. Successful exploitation can compromise confidentiality, integrity, and availability on the targeted host. Microsoft published guidance in the Microsoft Security Advisory CVE-2026-97755.
Critical Impact
An attacker who convinces a user to open a malicious Excel file can execute code in the context of the current user and establish a foothold on the endpoint.
Affected Products
- Microsoft Office Excel (version details available in the Microsoft Security Advisory)
Discovery Timeline
- 2026-10-13 - CVE CVE-2026-97755 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-97755
Vulnerability Analysis
The issue is an out-of-bounds read in the file-parsing logic of Microsoft Office Excel. When Excel processes a specially crafted spreadsheet, the parser reads memory beyond the bounds of an allocated buffer. The adjacent memory contents can influence program flow in ways that enable code execution in the user's context.
The attack is network-reachable because malicious documents are commonly delivered via email, SharePoint, OneDrive, or web downloads. User interaction is required, since a victim must open the crafted file for the vulnerable parsing path to execute. The current EPSS probability is approximately 0.80%.
Root Cause
The root cause is improper validation of input length or offset values in an Excel file-format structure. The parser trusts an attacker-controlled size or index and reads outside the intended buffer boundary. This [CWE-125] condition exposes adjacent heap or stack memory and can corrupt object state used by subsequent execution.
Attack Vector
An attacker crafts a malicious Excel document and delivers it through phishing, a shared link, or a drive-by download. When the victim opens the file in a vulnerable Excel client, the parser triggers the out-of-bounds read and executes attacker-controlled code. No prior authentication to the target system is required.
No verified proof-of-concept code is publicly available. See the Microsoft Security Advisory CVE-2026-97755 for vendor technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-97755
Indicators of Compromise
- Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
- Excel reading or writing files in unusual locations such as %TEMP%, %APPDATA%, or user profile startup folders shortly after opening an attachment.
- Outbound network connections initiated by EXCEL.EXE to unfamiliar IPs or domains following document open events.
Detection Strategies
- Hunt for Office-to-shell process lineage, specifically child processes of EXCEL.EXE that execute scripting interpreters or living-off-the-land binaries.
- Alert on Excel loading unexpected DLLs or writing executable content to disk following the open of an email or web-delivered spreadsheet.
- Correlate email gateway telemetry with endpoint document-open events to identify delivery of suspicious .xls, .xlsx, .xlsm, or .xlsb files.
Monitoring Recommendations
- Enable Microsoft Defender attack surface reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes.
- Collect process creation (Event ID 4688 or Sysmon Event ID 1) and image load telemetry from endpoints running Office.
- Monitor Office telemetry for crashes, exceptions, and Protected View bypass events that may indicate exploitation attempts.
How to Mitigate CVE-2026-97755
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Advisory CVE-2026-97755 as soon as testing permits.
- Prioritize patching for users who routinely open external spreadsheets, including finance, procurement, and HR teams.
- Validate that Protected View and Office File Block policies are enforced for documents from the internet.
Patch Information
Microsoft has issued an update addressing CVE-2026-97755. Refer to the vendor advisory for product versions, build numbers, and deployment guidance: Microsoft Security Advisory CVE-2026-97755.
Workarounds
- Keep Protected View enabled for documents originating from the internet and from Outlook attachments.
- Configure File Block policy in Group Policy to restrict legacy Excel binary formats where business processes allow.
- Enable Microsoft Defender ASR rules that prevent Office child-process creation and executable content execution from email and webmail.
- Deliver phishing-awareness guidance so users do not open unexpected spreadsheet attachments.
# Example: enable the ASR rule that blocks Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
-AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
