CVE-2026-97765 Overview
CVE-2026-97765 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel. An unauthorized attacker can execute arbitrary code over a network when a target opens a crafted Excel document. The flaw affects memory management when Excel parses malformed spreadsheet content, corrupting heap structures and enabling control of execution flow.
Critical Impact
Successful exploitation yields arbitrary code execution in the context of the user running Excel, with high impact to confidentiality, integrity, and availability. User interaction is required.
Affected Products
- Microsoft Office Excel (refer to the Microsoft CVE-2026-97765 Update Guide for exact affected builds)
Discovery Timeline
- 2026-10-13 - CVE CVE-2026-97765 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-97765
Vulnerability Analysis
The vulnerability is a heap-based buffer overflow in Microsoft Office Excel. Excel allocates a heap buffer sized for expected spreadsheet structures, then writes attacker-controlled data beyond the allocated boundary. The out-of-bounds write corrupts adjacent heap metadata and application objects.
An attacker can shape the heap layout so that overwritten structures include function pointers or virtual table references. Diverting those pointers to attacker-controlled memory produces arbitrary code execution in the Excel process.
Exploitation requires user interaction. A target must open a crafted spreadsheet delivered through email, a web download, a shared drive, or a collaboration platform. Code runs with the privileges of the signed-in user, which is often sufficient for credential theft, lateral movement, or ransomware staging.
Root Cause
The root cause is improper validation of a length or offset field during parsing of Excel file content. Excel trusts a size value from the input document and copies data into a heap buffer without enforcing a bound that matches the allocation, satisfying the definition of CWE-122.
Attack Vector
Delivery is network-based. Attackers typically send the malicious workbook as an email attachment or host it on a web server, OneDrive, SharePoint, or a third-party file share. Preview panes and automated document handlers can increase the exploitation surface. No verified proof-of-concept is published at the time of writing.
No verified exploit code is available for CVE-2026-97765. See the Microsoft CVE-2026-97765 Update Guide for authoritative technical details.
Detection Methods for CVE-2026-97765
Indicators of Compromise
- Excel (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
- Excel writing executable files, scripts, or scheduled task artifacts to disk shortly after opening an attachment.
- Outbound network connections from EXCEL.EXE to untrusted hosts following document open events.
- Crashes of EXCEL.EXE with heap corruption exceptions recorded in Windows Error Reporting.
Detection Strategies
- Hunt for process-tree anomalies where Office binaries create interpreter or script-host children.
- Correlate email gateway attachment metadata with endpoint document-open telemetry to flag freshly delivered .xls, .xlsx, .xlsm, and .xlsb files that trigger process creation.
- Flag Excel processes that load unusual DLLs from user-writable paths such as %TEMP% or %APPDATA%.
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes.
- Forward Office telemetry, Sysmon process creation, and image load events to a central analytics pipeline for retrospective hunting.
- Monitor Windows Error Reporting for repeated Excel crashes that may indicate exploitation attempts or payload instability.
How to Mitigate CVE-2026-97765
Immediate Actions Required
- Apply the Microsoft security update for CVE-2026-97765 to all systems running Office Excel, following the Microsoft CVE-2026-97765 Update Guide.
- Block inbound Excel attachments from external senders at the email gateway until patch deployment is complete.
- Enforce Protected View and Office Trusted Documents controls so files from the internet open in a sandboxed context.
Patch Information
Microsoft published guidance for CVE-2026-97765 in the Microsoft Security Response Center update guide. Administrators should consult the Microsoft CVE-2026-97765 Update Guide for the specific KB articles, affected build numbers, and distribution channels (Microsoft Update, WSUS, Microsoft 365 Apps update channels).
Workarounds
- Keep Protected View enabled for files originating from the internet, email attachments, and unsafe locations.
- Disable Excel macros by policy and restrict file formats permitted through the mail flow where business requirements allow.
- Apply Attack Surface Reduction rules that block Office child process creation and executable content from email and webmail.
# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
# Enable ASR rule: Block executable content from email client and webmail
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
