Description
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Published: 2026-10-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

The flaw is a double free in Microsoft Office Excel that can be triggered by an attacker who supplies a crafted Excel file over a network. This allows execution of arbitrary code with the privileges of the user running Excel, potentially compromising confidentiality, integrity, and availability. The underlying weakness is CWE-415: double free, and the resulting null pointer dereference relates to CWE-476.

Affected Systems

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server are affected by this vulnerability. Version details are not listed in the advisory.

Risk and Exploitability

The vulnerability carries a high CVSS score of 8.8, reflecting a serious threat. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been observed yet. The likely attack vector involves delivering a malicious Excel file over the network to an unsuspecting user, after which the attacker can run arbitrary code on the victim machine.

Generated by OpenCVE AI on October 14, 2026 at 14:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the security update released by Microsoft for CVE-2026-97767.
  • Restrict the ability of Excel to open files from untrusted network sources by configuring firewall or network segmentation rules.
  • Educate users to avoid opening unfamiliar Excel attachments and verify the sender before opening.
  • Monitor Excel process activity for unusual behavior to detect potential exploitation.

Generated by OpenCVE AI on October 14, 2026 at 14:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft microsoft 365 Apps For Enterprise
Microsoft microsoft Office 365 For Mac
Microsoft microsoft Office Ltsc 2021
Microsoft microsoft Office Ltsc 2024
Microsoft microsoft Office Ltsc For Mac 2021
Microsoft microsoft Office Ltsc For Mac 2024
Vendors & Products Microsoft microsoft 365 Apps For Enterprise
Microsoft microsoft Office 365 For Mac
Microsoft microsoft Office Ltsc 2021
Microsoft microsoft Office Ltsc 2024
Microsoft microsoft Office Ltsc For Mac 2021
Microsoft microsoft Office Ltsc For Mac 2024

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft microsoft 365
Microsoft office Online Server
CPEs cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*
cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*
cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*
Vendors & Products Microsoft microsoft 365
Microsoft office Online Server

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Title Microsoft Office Excel Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft 365 Apps
Microsoft office 2021
Microsoft office 2024
Microsoft office 365
Microsoft office Macos 2021
Microsoft office Macos 2024
Weaknesses CWE-415
CWE-476
CPEs cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*
cpe:2.3:a:microsoft:office_2021:*:*:*:*:ltsc:*:*:*
cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*
cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*
cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*
Vendors & Products Microsoft
Microsoft 365 Apps
Microsoft office 2021
Microsoft office 2024
Microsoft office 365
Microsoft office Macos 2021
Microsoft office Macos 2024
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft 365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise Microsoft Office 365 For Mac Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Office 2021 Office 2024 Office 365 Office Macos 2021 Office Macos 2024 Office Online Server
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:07:29.182Z

Reserved: 2026-09-25T04:32:19.230Z

Link: CVE-2026-97767

cve-icon Vulnrichment

Updated: 2026-10-13T19:33:21.191Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:22:14.487

Modified: 2026-10-15T21:19:30.860

Link: CVE-2026-97767

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T13:06:34Z

Weaknesses