The vulnerability is a heap-based buffer overflow in Microsoft Office Excel. An attacker who can deliver malicious content to a victim’s machine can trigger the overflow through a specially crafted Excel file or network communication, allowing arbitrary code execution with the privileges of the user running Excel. This flaw is classified as CWE‑122 and directly impacts the confidentiality, integrity, and availability of affected systems.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office Online Server. Version details are not explicitly listed in the CNA data; the described impact applies to all current releases of these products that have not applied the Microsoft security update for CVE‑2026‑97766.

The CVSS score of 8.8 indicates high severity. EPSS is not available, but the absence from the KEV catalog suggests that malicious exploitation is not yet widespread. The likely attack vector is network-based delivery of a malicious file or payload, as inferred from the description. An attacker must first obtain a way to deliver a crafted workbook or exploit a remote component of Excel; once executed, arbitrary code runs on the host.