{"id":"CVE-2026-97780","published":"2026-10-13T19:22:16.080","lastModified":"2026-10-15T21:19:32.450","description":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":["microsoft"],"products":["365 apps","microsoft 365","office 2021","office 2024","office online server"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97780","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in Microsoft Office Excel allows remote attackers to execute arbitrary code when processing maliciously crafted Excel files. This vulnerability could enable attackers to gain full control of affected systems without requiring user interaction beyond opening the file.","exploitability":"Exploitation is moderately difficult as it requires a remote attacker to deliver a specially crafted Excel file that triggers the buffer overflow, but once triggered, code execution is highly likely with minimal preconditions.","blast_radius":"The vulnerability affects Microsoft 365 apps, Office 2021, Office 2024, and Office Online Server, making it potentially widespread across enterprise environments where Excel files are commonly shared and opened.","remediation":"Deploy the Microsoft security update KB5040000 for Office 2021 and Office 2024, or upgrade to Microsoft 365 Apps version 2408 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","excel","office","buffer-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:22:52.336Z"}}