CVE-2026-97770: Microsoft Excel Buffer Overflow Vulnerability

CVE-2026-97770 Overview

CVE-2026-97770 is a stack-based buffer overflow [CWE-121] in Microsoft Office Excel. The flaw allows an unauthorized remote attacker to execute arbitrary code when a user opens a crafted Excel document. The vulnerability requires user interaction but does not require prior authentication or elevated privileges. Microsoft published the advisory on October 13, 2026.

Critical Impact
Successful exploitation enables remote code execution in the context of the current user, leading to full compromise of confidentiality, integrity, and availability on the targeted host.

Affected Products

Microsoft Office Excel (see the Microsoft Security Update Guide for specific build versions)
Microsoft 365 Apps distributions that bundle the vulnerable Excel component
Standalone Office installations that have not received the October 2026 security update

Discovery Timeline

2026-10-13 - CVE-2026-97770 published to NVD
2026-10-13 - Microsoft Security Update Guide advisory released
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97770

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] within Microsoft Office Excel's file parsing logic. Excel writes attacker-controlled data from a malformed spreadsheet into a fixed-size stack buffer without validating the input length. The resulting overflow corrupts adjacent stack memory, including the saved return address and structured exception handler records.

An attacker who crafts a malicious Excel document can hijack control flow during parsing. The attack vector is network-reachable because Excel documents are routinely delivered through email, shared drives, and web downloads. User interaction is required: the victim must open the weaponized file. Successful exploitation yields code execution with the privileges of the user running Excel.

The EPSS score of 0.738% reflects moderate near-term exploitation probability, consistent with other Office file-format bugs that frequently appear in phishing campaigns.

Root Cause

The root cause is missing bounds checking during the deserialization of a structured record inside the Excel binary or OOXML stream. A length field or record size supplied by the file is trusted and used directly to copy data into a stack-allocated buffer, producing the overflow condition described in [CWE-121].

Attack Vector

An attacker delivers a crafted .xls, .xlsx, or related Excel file through phishing email, instant messaging, a web download, or a trusted shared location. When the user opens the file, Excel parses the malicious record and triggers the overflow. The attacker can then execute code outside the Office sandbox depending on Protected View configuration and macro settings.

No working exploit has been published and the vulnerability is not listed on the CISA KEV catalog as of the publication date. See the Microsoft Security Update Guide entry for vendor-confirmed technical details.

Detection Methods for CVE-2026-97770

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, especially cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel process crashes with access violation exceptions in Windows Event Log immediately after opening an external document.
Outbound network connections initiated by EXCEL.EXE to previously unseen IP addresses or domains.
Creation of executable files or scheduled tasks shortly after an Excel document is opened from email or a browser download folder.

Detection Strategies

Hunt for process-lineage anomalies where EXCEL.EXE is the parent of script interpreters or LOLBins commonly abused for post-exploitation.
Inspect inbound email attachments and gateway downloads for Excel files containing malformed BIFF or OOXML records using static document analysis.
Correlate Office telemetry with endpoint behavioral alerts to identify shellcode patterns, heap sprays, or ROP indicators within the Excel process space.

Monitoring Recommendations

Enable and forward Microsoft Office telemetry, Sysmon process creation events, and image-load events to a centralized analytics platform.
Alert on Excel loading unusual DLLs from user-writable paths or on suspicious memory allocations in the Excel process.
Track file-open events sourced from Outlook, browsers, and messaging clients, and correlate with subsequent child-process activity.

How to Mitigate CVE-2026-97770

Immediate Actions Required

Apply the October 2026 Microsoft security update referenced in the Microsoft Security Update Guide to all systems running Microsoft Office Excel.
Prioritize patching endpoints used by executives, finance, and HR teams, which are the most frequent targets of malicious Excel attachments.
Block or quarantine inbound Excel attachments at the mail gateway until patches are confirmed deployed across the fleet.

Patch Information

Microsoft released a security update addressing CVE-2026-97770 on October 13, 2026. Refer to the Microsoft Security Update Guide for the specific KB articles and build numbers aligned with each supported Office channel.

Workarounds

Enforce Protected View for all documents originating from the internet, email, or untrusted locations to contain parsing of malicious files.
Disable or restrict legacy Excel file formats such as .xls and .xlsb through Trust Center File Block Settings where business processes permit.
Deploy Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes.
Enforce Microsoft Defender Application Guard for Office on supported SKUs to isolate untrusted documents in a hardware-based container.

bash

# Example Group Policy registry keys to harden Excel file handling
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\FileBlock" /v XL95Workbooks /t REG_DWORD /d 2 /f