Microsoft Fixes 11 Remote Code Execution Vulnerabilities in Excel

As part of the monthly security updates released on October 13, Microsoft patched 11 vulnerabilities in Excel. According to NVD records, the vulnerabilities affect Microsoft 365 Apps, Office 2021, and Office 2024 installations and allow an attacker to execute remote code.

What the vulnerabilities have in common: memory errors

All of the patched vulnerabilities stem from memory errors in Excel’s file-processing layer. The list includes heap-based buffer overflows (CVE-2026-97780, CVE-2026-97003, CVE-2026-97004, CVE-2026-97007, CVE-2026-97008, CVE-2026-88145, CVE-2026-77902), use-after-free (CVE-2026-97010), use of uninitialized resource (CVE-2026-97011), and out-of-bounds read (CVE-2026-70254) errors. One vulnerability (CVE-2026-97009) is a heap-based buffer overflow that allows local code execution.

According to Microsoft’s assessment, almost all of the vulnerabilities have a CVSS score of 8.8. The vector value indicates that the attack can be carried out over the network, requires user interaction, and that a successful attack has a high impact on confidentiality, integrity, and availability. The locally triggered CVE-2026-97009 is listed with a score of 7.8.

What this means in practice for users

These kinds of Excel vulnerabilities usually come into play when a crafted file is opened. An email attachment or a downloaded spreadsheet file can open the door to malicious content being executed. Because the vulnerabilities are in the memory corruption class, an attacker does not need to obtain macro permission; since Microsoft’s records include a user interaction requirement, the process largely depends on the file being opened. Given that Excel files are commonly used as attachments for invoices, quotes, and reports, it is worth thinking twice before opening spreadsheets from sources you do not recognize.

Update status

For now, the vulnerabilities are not on CISA’s actively exploited vulnerabilities list; in other words, there is no sign that they are being used in widespread attacks. Still, both enterprise and individual users of Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 should not delay the update. Microsoft 365 Apps installations receive the update through their own channel; users of Office 2021 and Office 2024 only need to install the relevant security update.

Source: Microsoft Security Update Guide · NVD