CVE-2026-97760: Microsoft Excel Information Disclosure Flaw

CVE-2026-97760 Overview

CVE-2026-97760 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. An unauthorized attacker can disclose information over a network by convincing a user to open a crafted file. The flaw affects the confidentiality of data processed by Excel but does not impact integrity or availability.

Microsoft published the advisory on October 13, 2026. Exploitation requires user interaction, typically opening a malicious spreadsheet. No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities (KEV) listing has been reported at the time of writing.

Critical Impact
Successful exploitation allows an unauthenticated remote attacker to read sensitive memory contents from Excel, potentially exposing data from the user's session or document.

Affected Products

Microsoft Office Excel (specific versions listed in the Microsoft Security Response Center advisory)
Microsoft 365 Apps editions that include Excel
Microsoft Office long-term servicing channel builds containing Excel

Discovery Timeline

2026-10-13 - CVE-2026-97760 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97760

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Office Excel. When Excel parses a specially crafted spreadsheet, the application reads memory beyond the bounds of an allocated buffer. The resulting data can leak into memory structures that an attacker-controlled document can later surface or exfiltrate.

The confidentiality impact is high while integrity and availability are unaffected. This pattern is consistent with information disclosure flaws that leak heap or stack contents rather than enabling arbitrary code execution. Attackers often chain such disclosures with other vulnerabilities to bypass mitigations such as Address Space Layout Randomization (ASLR).

Root Cause

The root cause maps to [CWE-125] Out-of-bounds Read. Excel's file parser does not correctly validate the size or offset of a structure within a crafted document before reading from the associated buffer. The parser returns data from memory adjacent to the intended region, which may contain fragments of other documents, pointers, or process state.

Attack Vector

The attack vector is network-based with required user interaction. A typical exploitation path involves delivering a malicious .xlsx, .xls, or related Excel file through email, a cloud share, or a web download. The victim opens the file, Excel parses the malformed structure, and the attacker receives leaked memory contents through document-level channels or follow-on telemetry.

The vulnerability does not require authentication and does not require elevated privileges on the target host. Refer to the Microsoft CVE-2026-97760 Update Guide for parser-level details.

Detection Methods for CVE-2026-97760

Indicators of Compromise

Unexpected Excel files arriving from untrusted senders, particularly files with embedded external references, unusual OLE streams, or malformed records
Excel processes (excel.exe) establishing outbound network connections to unfamiliar domains shortly after opening a document
Crash telemetry or Windows Error Reporting events referencing Excel parser modules when opening specific files

Detection Strategies

Inspect inbound Excel attachments at the mail gateway and sandbox detonation layer, flagging files that trigger parser anomalies or memory read violations
Correlate Office telemetry with endpoint detection and response (EDR) events to identify Excel processes exhibiting abnormal file read patterns or network callbacks
Hunt for Excel child processes spawning scripting hosts such as powershell.exe, wscript.exe, or cmd.exe following document open events

Monitoring Recommendations

Enable Microsoft Office cloud-delivered protection and attack surface reduction (ASR) rules that block Office applications from creating child processes
Forward Office and endpoint telemetry to a central data lake for retrospective hunting once vendor indicators are published
Alert on Excel accessing sensitive file shares or credential stores after opening attachments from external sources

How to Mitigate CVE-2026-97760

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-97760 Update Guide across all systems running Microsoft Office Excel
Prioritize patching for users who routinely open spreadsheets from external sources, including finance, procurement, and executive assistant roles
Verify that Microsoft 365 Apps update channels are current and that offline or VDI images include the fixed build

Patch Information

Microsoft has issued updates addressing CVE-2026-97760 through its monthly security update process. Administrators should consult the Microsoft Security Response Center advisory for the exact Office build numbers and Click-to-Run or MSI package identifiers that remediate this issue. Deploy the updates through Windows Update, Microsoft Intune, Microsoft Configuration Manager, or Windows Server Update Services (WSUS).

Workarounds

Enable Protected View and Office File Block policies to prevent Excel from fully parsing files received from the internet or email attachments
Disable preview handlers for Excel file types in Outlook and Windows Explorer to reduce automatic parsing of untrusted content
Restrict delivery of legacy binary Excel formats (.xls, .xlsb) at the mail gateway when business processes allow

bash

# Example Group Policy registry keys to enforce Protected View for Excel
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f