{"id":"CVE-2026-97745","published":"2026-10-13T19:22:11.823","lastModified":"2026-10-15T21:19:28.367","description":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":["microsoft"],"products":["365 apps","microsoft 365","office 2021","office 2024"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97745","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in Microsoft Office Excel allows remote attackers to execute arbitrary code when a malicious file is opened. This occurs when the application frees memory that is still being referenced, potentially leading to code execution with the privileges of the user who opened the file.","exploitability":"Exploitation requires a user to open a specially crafted Excel file, making it moderately difficult but achievable through social engineering or phishing campaigns.","blast_radius":"The vulnerability affects Microsoft 365 apps, Office 2021, and Office 2024, meaning a large portion of enterprise users could be impacted if exploited.","remediation":"Deploy the Microsoft Excel update KB5040348 or later to address this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","excel","office","remote"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:20:10.063Z"}}