CVE-2026-97758

Executive Summary

CVE-2026-97758 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code over a network. The vulnerability carries a CVSS base score of 8.8 (High) and requires user interaction (UI:R) to trigger, meaning the victim must open or interact with a crafted document. Successful exploitation yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H) within a single security scope, enabling remote code execution in the context of the victim user.

Technical Analysis

CVE-2026-97758 is classified as a heap-based buffer overflow (CWE-122) affecting Microsoft Office Excel. A heap-based buffer overflow occurs when a program writes more data to a heap-allocated buffer than it can hold, corrupting adjacent heap memory. This corruption can overwrite control structures or function pointers, which an attacker can leverage to redirect execution flow and run arbitrary code.

The attack vector is network-based (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N), but it demands user interaction (UI:R). This is a classic client-side, document-triggered memory corruption scenario: the attacker delivers a malicious Excel file (or a network-hosted resource that Excel parses) to a target, and the victim must open or otherwise interact with that content. Because the flaw is triggered during parsing or processing of attacker-controlled data, the vulnerable component is the Excel application's handling of crafted input.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the vulnerability impacts only the vulnerable component itself (S:U) rather than crossing a security boundary, but grants high impact across all three CIA triad dimensions once code execution is achieved. The network attack vector combined with low complexity makes this attractive to commodity and targeted attackers alike.

Important note on precision: The NVD description provided for this CVE is sparse and does not specify the exact parsing routine, object type, file format element, or memory operation that overflows. No function names, class names, file paths, or API parameters are available in the source data and none should be assumed. The vulnerability mechanism is therefore described at the vulnerable-class level (heap buffer overflow during Excel document processing) rather than at a fabricated code level.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-97758 (PoC_STATUS: None). The attack chain below is inferred strictly from the vulnerability class (heap-based buffer overflow in a client application triggered over a network) and the CVSS parameters — no specific implementation details are invented.

1. Reconnaissance / target identification: The attacker identifies targets that use Microsoft Office Excel, typically through phishing pretexts, supplier/customer communication channels, or watering-hole placement. Because PR:N, no prior credentials or foothold on the victim system are required. Shodan or asset inventory can identify organizations with exposed Office-related collaboration or file-sharing surfaces that could host a malicious workbook.

2. Triggering the flaw (vulnerability-class level): The attacker crafts an Excel document containing data that causes the application to write beyond the bounds of a heap-allocated buffer during processing. Delivery is network-based (AV:N), most commonly via email attachment, a link to a hosted workbook, or a shared document on a collaboration platform. Because the flaw requires user interaction (UI:R), the victim must open the file or otherwise cause Excel to parse the malicious content. The overflow corrupts heap memory, which the attacker aims to leverage for control-flow hijacking. The exact malformed structure is unknown because no technical detail is published.

3. Payload / execution method: Successful heap corruption in a client process typically enables the attacker to execute code in the context of the Excel process — that is, as the logged-on victim user. The specific exploitation primitive (e.g., overwriting an adjacent object or vtable pointer) is not disclosed and must not be assumed. What is derivable from CVSS is only that reliable low-complexity network-triggered execution is assessed (AC:L, C:H/I:H/A:H).

4. Post-exploitation impact: Because the code executes as the victim user, the attacker gains the user's file, email, and browser-session access, can establish persistence, pivot laterally using the victim's credentials, and exfiltrate data. The S:U scope means the direct CVSS impact is bounded to the vulnerable component, but in real-world operations user-context code execution frequently expands well beyond that boundary through credential and token abuse.

Impact Assessment

The CVSS base score of 8.8 (High) reflects high confidentiality, integrity, and availability impact (C:H/I:H/A:H). Confidentiality impact is high because code execution can read any data accessible to the victim user, including documents, credentials cached in the user context, and network-accessible file shares. Integrity impact is high because the attacker can modify documents, install software, and alter system state as the user. Availability impact is high because the attacker can crash Excel, encrypt or delete documents, or degrade the endpoint.

The blast radius is bounded primarily by the privileges of the user who opens the malicious file. Documents opened from email or downloaded from the web often run with Protected View or Mark-of-the-Web restrictions, which may reduce exploitability in default configurations; however, the CVSS assessment of no privileges required and low complexity assumes the attack path is viable against real deployments. Because the CVE is UNPATCHED with no vendor fix or workaround available, every unmitigated Excel deployment that processes documents from untrusted sources is potentially exposed.

Detection Guidance

Sigma Rule

title: Suspicious Excel Process Spawning Child Process
id: 8f3c1a2e-5b7d-4c9a-9e21-cve202697758
status: experimental
description: Detects Microsoft Excel spawning a child process, a behavior frequently associated with exploitation of memory corruption flaws such as CVE-2026-97758.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97758
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\EXCEL.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Excel macros or add-ins spawning helper processes
level: high

YARA Rule

rule CVE_2026_97758_Excel_Heap_Overflow_Carrier
{
    meta:
        description = "Heuristic detection of suspicious OLE/Excel documents that may carry malformed data targeting CVE-2026-97758"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97758"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ole = { D0 CF 11 E0 A1 B1 1A E1 }
        $zip = { 50 4B 03 04 }
        $workbook = "xl/workbook.xml" ascii
        $vbaproject = "vbaProject.bin" ascii
        $macro = "Auto_Open" ascii nocase

    condition:
        ($ole at 0 or $zip at 0) and
        ($workbook or $vbaproject) and
        filesize < 5MB
}

Note: The YARA rule is necessarily generic because no specific byte signature, embedded structure, or exploited object is published for this CVE. It flags the document carriers relevant to this vulnerability class; it is not a definitive detector for the malformed data itself, which remains undisclosed.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97758 Microsoft Excel Malicious Document Download (xls/xlsx)"; flow:established,to_client; http.method; content:"GET"; http.response_body; content:"|D0 CF 11 E0|"; depth:4; fileext:"xls"; filestore; sid:9775801; rev:1;)

Note: No network signature specific to the vulnerable code path can be derived from the available data. The rule targets retrieval of Excel document carriers, which is the delivered artifact for a document-triggered overflow. Tune file extensions and thresholds to the environment to control false positives on normal .xls/.xlsx traffic.

Elastic Detection

process where event.type == "start" and
  process.parent.name : "excel.exe" and
  process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                  "mshta.exe", "rundll32.exe", "regsvr32.exe")

This detects the anomaly of Excel spawning interpreters or LOLBins, the strongest generic post-exploitation signal for client-side Office memory corruption.

Splunk SPL Query

index=windows EventCode=4688
| where match(ParentProcessName, "(?i)EXCEL\.EXE$")
| where match(NewProcessName, "(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$")
| stats count min(_time) as first_seen max(_time) as last_seen
  values(NewProcessName) as children values(CommandLine) as cmdlines
  by ComputerName, User, ParentProcessName
| where count > 0

Correlates process creation telemetry (4688 or Sysmon Event ID 1) to surface Excel-initiated child processes. Review the command line of any child for encoded or download commands.

Wazuh OSSEC Rule

<group name="windows,sysmon,">
  <rule id="977580" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">EXCEL.EXE$</field>
    <field name="win.eventdata.image">(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$</field>
    <description>CVE-2026-97758: Microsoft Excel spawned a suspicious child process - possible exploitation (RCE)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Enforce Microsoft Defender Attack Surface Reduction (ASR) rules, especially "Block Office applications from creating child processes" and "Block Office applications from injecting code into other processes."
   • Keep Protected View, Application Guard for Office, and Mark-of-the-Web enforcement enabled so documents from email and the internet are opened in a sandboxed or read-only container.
   • Block macros and dangerous file types from internet-originated email at the gateway, and quarantine unsolicited .xls/.xlsx/.xlsm attachments.
   • Apply least privilege to users so that a compromised Office process cannot write to sensitive locations or elevate. Enforce EDR with memory-corruption and exploit-mitigation telemetry (Windows Defender Exploit Guard, ASLR, CFG, CET where available).
   • Update EDR signatures and detection content to alert on Excel spawning interpreters/LOLBins.

2. Patch/upgrade steps: No vendor patch, fixed version, or advisory is currently available in tracked sources. Monitor Microsoft's Security Update Guide and the Microsoft 365 Apps release notes for an out-of-band or monthly security update, and apply it immediately upon release. Until then, treat all Excel document processing from untrusted sources as high risk.

3. Long-term hardening: Segment and restrict lateral movement, reduce the number of users who can open external documents with full trust, maintain a software inventory of Office versions and update channels, and exercise phishing-resilient controls (browser isolation, email authentication, user awareness). Retire legacy Office versions in favor of a supported Microsoft 365 Apps channel that receives regular security updates.

References

1. NVD — CVE-2026-97758: https://nvd.nist.gov/vuln/detail/CVE-2026-97758
2. CWE-122 — Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
3. MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
4. Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide
5. CISA Known Exploited Vulnerabilities Catalog (no current entry for CVE-2026-97758 — confirmed not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and exploit-in-the-wild evidence: None available. No public PoC, no exploit code, no Nuclei template, no CISA KEV listing, and no associated campaign reporting exist for CVE-2026-97758 at the time of writing. EPSS has not scored this CVE; no EPSS value is asserted here.