CVE-2026-97777 Microsoft Office Excel Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft 3 versions
-
2 new sentences, beginning: “Updated an acknowledgement.”
CVE-2026-97777 Microsoft Office Excel Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
-
4 new sentences, beginning: “Microsoft is announcing the availability of the security updates for Microsoft Office for Mac.”
CVE-2026-97777 Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft Office software do not need to take any action. See the [Release Notes](https://go.microsoft.com/fwlink/p/?linkid=831049) for more information and download links.
-
CVE-2026-97777 Microsoft Office Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Versions are compared on the headline and summary the publisher puts in their feed. An edit to the body of an article that leaves both untouched will not appear here.
Why am I seeing this Ranked on source trust — Microsoft
It ranks mainly on source trust: Microsoft is the most reliable outlet we track on this subject, and is the only one on the story so far.
It clears the bar without leading strongly on any one factor. A middling score is not a claim that the story is important — only that nothing about it is weak.
StandardStandard, because a first-party source is on it, the subject was identified from the text, and it scores 0.49 against a bar of 0.50.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroboration | 0.35 | 0.39 | +0.135 28% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trustleads | 0.25 | 1.00 | +0.250 51% | Microsoft is the highest-trust source on this story and is first-party — the organisation announcing its own news. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.50 | +0.101 21% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
Microsoft Office Excel contains a heap-based buffer overflow vulnerability that permits attackers to execute code remotely over a network. The flaw is tracked as CVE-2026-97777 and affects the application's memory handling during processing of certain inputs.
The vulnerability enables remote code execution when a user interacts with a specially crafted file or network-based attack vector. An attacker does not require authentication or user privileges beyond the ability to deliver the malicious content to a target system.
Microsoft has released security updates for Office on Mac to address this issue. Users running affected Mac versions of Microsoft Office should install the available update. Customers using other Microsoft Office software versions do not require action at this time.
What happened
Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft Office software do not need to take any action. See the [Release Notes](https://go.microsoft.com/fwlink/p/?linkid=831049) for more information and download links.
Limited impact or meaningful preconditions.
- Impact
- Remote Code Execution
- Product
- Microsoft Office Excel
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Microsoftfirst-party first seen CVE-2026-97777 Microsoft Office Excel Remote Code Execution Vulnerability
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.