CVE-2026-97780: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-97780 Overview

CVE-2026-97780 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel that enables remote code execution. An unauthorized attacker can execute arbitrary code on a target system by delivering a crafted spreadsheet. Exploitation requires the victim to open the malicious file, satisfying the user interaction requirement in the CVSS vector.

The flaw affects multiple Office product families, including Microsoft 365 Apps, Office 2021, Office 2024, and Office Online Server. Microsoft published the advisory through the Microsoft Security Response Center update guide. Code execution occurs in the context of the user running Excel, which can lead to full account compromise on workstations without privilege separation.

Critical Impact
Successful exploitation grants arbitrary code execution in the user context, enabling malware installation, credential theft, and lateral movement from a single opened spreadsheet.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft 365 for macOS
Microsoft Office 2021 and Office 2024 (LTSC, Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-10-13 - CVE-2026-97780 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-97780

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Office Excel's file parsing logic. When Excel processes a crafted spreadsheet, a sized allocation on the heap receives more data than its boundary permits. The overflow corrupts adjacent heap metadata or object pointers, which an attacker uses to redirect execution flow.

Because the overflow occurs during document parsing, the attack path is reachable before any user action beyond opening the file. Protected View and Mark-of-the-Web can interrupt the chain, but attackers routinely bypass these mitigations through social engineering or trusted-location delivery. The impact spans confidentiality, integrity, and availability.

The EPSS probability sits at roughly 0.80 percent at the time of publication, which reflects early-cycle scoring rather than low exploitability. Office document parsers remain a high-value target for both commodity and targeted actors.

Root Cause

The root cause is improper validation of a size or length field during deserialization of structured Excel content. The parser allocates a heap buffer based on one value and then writes a larger amount of attacker-controlled data into it, matching the [CWE-122] pattern.

Attack Vector

The attack vector is network-based delivery of a malicious .xlsx, .xls, or related Excel file. Common delivery channels include email attachments, SharePoint or OneDrive links, chat platforms, and watering-hole downloads. The victim must open the file in a vulnerable Excel build for exploitation to succeed.

See the Microsoft Security Update Guide for official technical details.

Detection Methods for CVE-2026-97780

Indicators of Compromise

Excel (EXCEL.EXE) spawning child processes such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, or mshta.exe.
Unexpected outbound network connections initiated by EXCEL.EXE to untrusted IPs or domains shortly after a document is opened.
Writes of executable content (.exe, .dll, .hta, .js) by Excel into user-writable paths such as %APPDATA%, %TEMP%, or %PUBLIC%.
Excel process crashes with exception codes consistent with heap corruption (0xC0000374, 0xC0000005) correlated with recently received attachments.

Detection Strategies

Hunt for Office applications loading unusual DLLs or spawning scripting hosts, mapped to MITRE ATT&CK techniques T1203 (Exploitation for Client Execution) and T1566.001 (Spearphishing Attachment).
Alert on files with Mark-of-the-Web being opened directly from mail or browser cache followed by process creation anomalies.
Correlate Windows Error Reporting (WER) crash telemetry from EXCEL.EXE with endpoint and email gateway data to surface exploitation attempts.

Monitoring Recommendations

Enable and forward Microsoft Defender for Office 365 or equivalent email gateway telemetry to the SIEM for attachment-level visibility.
Collect Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) from endpoints running Excel to support exploitation detection.
Track Office version and patch inventory continuously to identify unpatched endpoints exposed to CVE-2026-97780.

How to Mitigate CVE-2026-97780

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide across all affected Office channels, including macOS and Office Online Server.
Verify that Protected View and Office Attack Surface Reduction (ASR) rules blocking child process creation from Office applications are enforced.
Prioritize patching for high-risk users such as finance, executive assistants, and external-facing roles who frequently receive spreadsheets.

Patch Information

Microsoft has issued updates for Microsoft 365 Apps, Office 2021 LTSC, Office 2024 LTSC, Microsoft 365 for macOS, and Office Online Server. Install the latest cumulative Office update for the affected channel and confirm the build number matches the fixed version listed in the Microsoft advisory. Office Online Server administrators must apply the server-side package and restart affected services.

Workarounds

Block or quarantine inbound Excel attachments at the email gateway when patching cannot be completed immediately.
Enforce Protected View for files originating from the Internet and from Outlook attachments through Group Policy.
Deploy ASR rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office applications from creating child processes.
Restrict macro and add-in execution to signed, trusted publishers only.

bash

# Example: enforce ASR rule to block Office child processes via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled