CVE-2026-97755

Executive Summary

CVE-2026-97755 is an out-of-bounds read (CWE-125) vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), reflecting a network-reachable attack path that requires user interaction but yields high confidentiality, integrity, and availability impact. No patch, public proof-of-concept, or exploit code is currently available, making proactive detection and mitigation critical for affected organizations.

Technical Analysis

CVE-2026-97755 is classified as an out-of-bounds read (CWE-125) affecting Microsoft Office Excel. An out-of-bounds read occurs when software reads data past the end (or before the beginning) of an allocated memory buffer. In the context of document-parsing applications such as Excel, this class of flaw is typically triggered when the application processes a malformed file or data structure that causes the parser to compute an incorrect buffer boundary or index, resulting in memory being read outside the intended allocation.

The NVD description states the flaw allows "an unauthorized attacker to execute code over a network." This is a notable escalation for an out-of-bounds read: while OOB reads most commonly lead to information disclosure (memory contents leaking into output or being used to defeat ASLR), they can be chained into code execution when the out-of-bounds data is subsequently used as a pointer, index, or length value in a way that corrupts control flow or enables further memory corruption. The CVSS vector confirms impact to confidentiality, integrity, and availability (all rated High), which is consistent with a flaw that can be leveraged beyond simple information disclosure into code execution.

The attack surface is the Excel document-processing engine. The CVSS vector AV:N (network) combined with UI:R (user interaction required) indicates the attacker delivers the malicious content remotely — most plausibly a crafted spreadsheet or document — and the victim must open or otherwise interact with it for exploitation to succeed. PR:N indicates no privileges are required on the attacker's side, and S:U indicates the exploit does not cross a security authority boundary (impact is confined to the vulnerable component's security context).

Important caveat on technical specificity: The source data provided for this CVE contains no CNA title, no affected version range, no vendor advisory, and no function-, class-, or file-level detail. Consequently, no specific parser routines, file-format structures, or memory offsets can be named without fabrication. The mechanism described above is accurate at the vulnerability-class level (out-of-bounds read leading to potential code execution) but should not be treated as confirmation of any particular implementation detail. Analysts should await the vendor advisory or NVD enrichment for the precise affected component and trigger condition.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-97755. The attack chain below is inferred strictly from the vulnerability class (CWE-125, out-of-bounds read) and the CVSS vector provided. No specific function names, file paths, or API parameters are invented.

1. Reconnaissance / target identification. The attacker identifies an organization or individual that uses Microsoft Office Excel and can be reached with a document-based lure. Because the vector is AV:N with UI:R, the attacker does not need direct network access to the victim host — delivery of a file through any channel (email attachment, shared drive, chat, download link) is sufficient.

2. Triggering the flaw. The attacker crafts a document that, when processed by Excel, causes the out-of-bounds read condition described in CWE-125. The precise malformed structure is not disclosed in the available data; at the vulnerability-class level, this means supplying input that drives the parser to read memory outside an allocated buffer.

3. Payload / execution method. The description states the outcome is code execution. At the class level, an attacker who can influence what is read out-of-bounds, or how the out-of-bounds data is subsequently used, may be able to corrupt or redirect program state and achieve arbitrary code execution in the context of the Excel process. The exact primitive is not specified in the available data and should not be assumed.

4. Post-exploitation impact. Because the flaw is rated S:U and results in code execution, the attacker would operate with the privileges of the user running Excel (C:H/I:H/A:H). This could enable data theft, document tampering, and further lateral movement or persistence depending on the environment and the exploited process context.

Note: No public PoC available; attack chain is inferred from vulnerability class. No exploit-in-the-wild evidence or threat-actor campaign attribution is present in the provided data.

Impact Assessment

The CVSS v3.1 base score is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Breakdown of subscores:

• Attack Vector (Network, AV:N): Exploitation is achievable remotely — the malicious content does not require the attacker to be on the same local segment. This increases the reachable population of potential targets.
• Attack Complexity (Low, AC:L): No special conditions or race windows are described; exploitation does not depend on hard-to-control factors per the base vector.
• Privileges Required (None, PR:N): The attacker needs no prior account or privilege on the target system.
• User Interaction (Required, UI:R): A user must open or otherwise interact with the crafted content — this is the primary friction point and the main reason the score is not Critical. It also makes the flaw well-suited to phishing and social-engineering delivery.
• Scope (Unchanged, S:U): Impact is confined to the vulnerable component's security context; the exploit does not inherently pivot to a different security authority.
• Confidentiality / Integrity / Availability (all High): Code execution implies potential full compromise of data confidentiality, data integrity, and process/system availability within the affected context.

Business impact: Excel is ubiquitous in enterprise environments. A remotely deliverable, user-interaction-triggered code-execution flaw in Excel presents a significant endpoint risk, particularly in organizations with weak email-attachment controls or macro/document-execution policies. Blast radius is bounded by the privileges of the user who opens the malicious document, but in many corporate environments that equates to broad access to file shares, email, and cloud-connected documents. The absence of a patch and the absence of a public PoC are mitigating-timing factors at present; both can change quickly once the flaw is analyzed publicly.

Detection Guidance

Sigma Rule

title: Potential Microsoft Excel Out-of-Bounds Read Exploitation (CVE-2026-97755)
id: 8f2a1c4e-3b7d-4a91-9c2e-6d5f0a1b7e33
status: experimental
description: Detects suspicious child process creation or anomalous behavior originating from Microsoft Excel, consistent with code execution following an out-of-bounds read (CWE-125) in Excel (CVE-2026-97755).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97755
author: Threat Intelligence Team
date: 2026/01/01
tags:
  - attack.t1203
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\EXCEL.EXE'
  selection_children:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  filter_legit:
    CommandLine|contains:
      - 'Microsoft Office'
  condition: selection_parent and selection_children and not filter_legit
falsepositives:
  - Legitimate Excel macros or add-ins that spawn scripting engines
  - Software installers launched from Excel-based tooling
level: high

YARA Rule

rule CVE_2026_97755_Excel_OOB_Read
{
    meta:
        description = "Detection aid for crafted Excel documents potentially exploiting an out-of-bounds read (CWE-125) in Microsoft Office Excel (CVE-2026-97755). Heuristic OLE/Office container matching; tune per environment."
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97755"
        cve = "CVE-2026-97755"
        severity = "high"

    strings:
        $ole_magic  = { D0 CF 11 E0 A1 B1 1A E1 }
        $zip_magic  = { 50 4B 03 04 }
        $ole_stream = "Workbook" ascii wide nocase
        $ole_sheet  = "Worksheet" ascii wide nocase

    condition:
        (uint16(0) == 0x4B50 or $ole_magic at 0) and
        any of ($zip_magic, $ole_magic) and
        1 of ($ole_stream, $ole_sheet) and
        filesize < 50MB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-97755 Potential Microsoft Excel Malicious Document Retrieval (OLE/Office container in HTTP download)"; flow:established,to_server; content:"POST"; http_method; content:"|D0 CF 11 E0 A1 B1 1A E1|"; http_client_body; depth:8; sid:202697755; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-97755, confidence low; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97755; classtype:attempted-user;)

Elastic Detection

process where event.type == "start" and
  process.parent.name == "EXCEL.EXE" and
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "bitsadmin.exe", "certutil.exe")

Splunk SPL Query

index=windows (EventCode=1 OR EventCode=4688)
| search ParentImage="*\\EXCEL.EXE"
| search Image IN ("*\\cmd.exe","*\\powershell.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\bitsadmin.exe","*\\certutil.exe")
| stats count values(Image) as child_processes values(CommandLine) as cmdlines by ComputerName, User, ParentImage
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="windows,sysmon,">
  <rule id="2027755" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">EXCEL.EXE</field>
    <field name="win.eventdata.image">cmd.exe|powershell.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe|bitsadmin.exe|certutil.exe</field>
    <description>CVE-2026-97755: Suspicious child process spawned by Microsoft Excel, possible exploitation of out-of-bounds read (CWE-125)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_97755,office_excel,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (no vendor patch available):

• Enforce strict attachment and document filtering at the email gateway and web proxy; block or sandbox untrusted Office documents from external senders.
• Disable or restrict Microsoft Office macros and ActiveX via Group Policy (e.g., block macros in files from the internet, disable trusted locations for untrusted paths, and require signing).
• Deploy Microsoft Defender Attack Surface Reduction (ASR) rules, particularly those that block Office applications from creating child processes and from creating executable content.
• Enable Protected View and Application Guard for Office where available to isolate document rendering.
• Segment and restrict endpoint egress so that a compromised Excel process cannot easily reach command-and-control infrastructure.

2) Patch/upgrade steps:

• No patch is currently available from any tracked source. Monitor the Microsoft Security Response Center (MSRC) and Microsoft Update for an official fix. When released, prioritize patching across all endpoints with Microsoft Office Excel installed, and validate that the patched build replaces vulnerable installations.
• Subscribe to the NVD entry and vendor advisory feed for CVE-2026-97755 to be notified when remediation guidance is published.

3) Long-term hardening:

• Adopt a least-privilege model for productivity users to limit the impact of code execution in the Excel context.
• Maintain endpoint detection and response (EDR) coverage with Office-aware process-tree monitoring (see detection rules above).
• Implement application allowlisting to prevent unexpected child processes from Office applications.
• Conduct regular user awareness training focused on document-based phishing, since exploitation requires user interaction.
• Track EPSS once scored by FIRST.org to inform exposure prioritization.

References

• NVD — CVE-2026-97755: https://nvd.nist.gov/vuln/detail/CVE-2026-97755
• CWE-125 (Out-of-bounds Read): https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• Microsoft Security Response Center (MSRC) advisories: https://msrc.microsoft.com/update-guide
• FIRST.org EPSS (score pending at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-97755 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-97755 in the available data. No public PoC or exploit code has been observed.