{"id":"CVE-2026-97754","published":"2026-10-13T19:22:12.973","lastModified":"2026-10-15T21:19:29.397","description":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":["microsoft"],"products":["365 apps","microsoft 365","office 2021","office 2024","office online server"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97754","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code when processing maliciously crafted Excel files. This vulnerability can be exploited over the network without user interaction, making it particularly dangerous for organizations that frequently exchange Excel files.","exploitability":"Exploitation is moderately difficult as it requires crafting a specific malicious Excel file and convincing a target to open it, but the attack surface is large since Excel is widely used and often opened automatically by email attachments or shared documents.","blast_radius":"If exploited, this vulnerability could lead to full system compromise across an organization, as attackers could execute arbitrary code on vulnerable systems with the privileges of the user who opened the malicious file.","remediation":"Deploy Microsoft Security Update KB5041234 immediately to all affected Office 2021 and Office 2024 installations.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","excel","remote"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:20:52.983Z"}}