CVE-2026-97779: Microsoft Excel Information Disclosure Flaw

CVE-2026-97779 Overview

CVE-2026-97779 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. The flaw allows an unauthorized attacker to disclose information over a network when a user opens a specially crafted file. Exploitation requires user interaction but no authentication. The vulnerability affects confidentiality only; it does not permit modification of data or disruption of service.

Critical Impact
Successful exploitation leaks sensitive memory contents from the Excel process, which may include document data, cached credentials, or address information useful for chaining with code execution flaws.

Affected Products

Microsoft Office Excel (specific builds listed in the Microsoft Security Update Guide)
Microsoft 365 Apps for Enterprise
Microsoft Office LTSC editions documented in the vendor advisory

Discovery Timeline

2026-10-13 - CVE-2026-97779 published to the National Vulnerability Database
2026-10-13 - Last updated in the NVD database

Technical Details for CVE-2026-97779

Vulnerability Analysis

The issue is an out-of-bounds read in the Excel file parsing logic. When Excel processes a malformed spreadsheet, it reads memory beyond the bounds of an allocated buffer. The adjacent memory contents are then incorporated into application state, from which an attacker can recover them.

Exploitation is network-reachable because Excel documents are routinely delivered through email, cloud storage links, and web downloads. The attacker crafts a malicious workbook and persuades a user to open it. No elevated privileges are required on the target system.

The EPSS probability is 0.853% at the 57th percentile, indicating moderate near-term exploitation likelihood relative to the broader CVE population. There are no public exploits or CISA KEV entries at the time of publication.

Root Cause

The root cause is missing bounds validation when parsing a structured field within an Excel document. The parser trusts a size or offset value from the file and reads past the end of the intended buffer. See the Microsoft Security Update Guide for the authoritative technical description.

Attack Vector

An attacker delivers a crafted .xlsx, .xls, or related Excel file to the victim through phishing, shared drives, or a drive-by download. When the user opens the file, the parser reads adjacent process memory. The leaked data is then exfiltrated through the document's rendered content or a secondary channel.

No verified proof-of-concept code is available. Refer to the vendor advisory for sanitized technical details.

Detection Methods for CVE-2026-97779

Indicators of Compromise

Excel processes (EXCEL.EXE) spawning unexpected network connections shortly after opening attachments
Office documents arriving from external senders with embedded macros, external links, or unusually structured workbook streams
Crash telemetry or Windows Error Reporting entries referencing Excel parser modules

Detection Strategies

Inspect inbound email attachments and web downloads for Excel files with malformed BIFF or OOXML structures
Correlate Excel process launches with subsequent outbound HTTP, DNS, or SMB traffic to uncommon destinations
Enable Microsoft Defender for Office 365 Safe Attachments or an equivalent sandbox to detonate Office files before delivery

Monitoring Recommendations

Log Office application child process creation and network activity through EDR telemetry
Alert on Excel reading files from temporary internet directories followed by external connections
Track patch deployment status for Microsoft Office across the fleet to measure exposure

How to Mitigate CVE-2026-97779

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide across all Office installations
Prioritize patching for users who frequently receive external Excel attachments, including finance and procurement teams
Reinforce user guidance to avoid opening unsolicited spreadsheets, even when they appear to come from known senders

Patch Information

Microsoft published the fix on 2026-10-13. Administrators should consult the Microsoft Security Update Guide for build numbers and KB identifiers that correspond to each supported Office channel and Microsoft 365 Apps release.

Workarounds

Enable Protected View for files originating from the internet and from Outlook attachments
Configure Office File Block policy to prevent opening legacy Excel formats from untrusted locations
Route inbound Office files through an attachment sandbox and strip or quarantine malformed workbooks

bash

# Enforce Protected View for internet-sourced Office files via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f