CVE-2026-97762

Executive Summary

CVE-2026-97762 is an out-of-bounds write vulnerability (CWE-787) in Microsoft Office Excel that permits an unauthorized attacker to execute code over a network. Per the NVD description, successful exploitation requires user interaction, but no privileges are required and the impact to confidentiality, integrity, and availability is rated High across all three categories (CVSS 8.8). Organizations running Microsoft Excel on endpoints that open externally sourced documents are affected; a malicious file delivered by network means can corrupt memory beyond intended buffer boundaries and, in the worst case, lead to arbitrary code execution in the context of the victim user.

Technical Analysis

The vulnerability is classified as an out-of-bounds write (CWE-787), which falls under the broader memory-safety category CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). An out-of-bounds write occurs when software writes data past the end (or before the beginning) of an allocated buffer. In the context of document-parsing applications such as Microsoft Excel, such flaws are typically reached while processing attacker-controlled structures embedded in a file — for example, malformed records or length fields that cause the parser to compute an incorrect size and then write beyond the destination buffer.

The NVD description states the flaw allows "an unauthorized attacker to execute code over a network." This phrasing indicates that (a) the attacker does not need valid credentials or prior access to the target system, and (b) the attack can be delivered across a network boundary, most plausibly via a malicious document delivered through email, a network share, a web download, or another file-transfer channel that the victim then opens in Excel. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is consistent with this reading: network attack vector, low attack complexity, no privileges required, user interaction required, scope unchanged, and high impact to confidentiality, integrity, and availability.

The specific code path, vulnerable function, file format structure, or memory-corruption primitive is not disclosed in the available CNA Title or NVD Description. No affected version range, vendor advisory, patch reference, or PoC has been published in the tracked sources. Consequently, this report describes the vulnerability at the class level and avoids asserting implementation details that are not supported by the provided data.

Because the vulnerability resides in document parsing rather than in a network-facing service, the primary attack surface is the Excel client on any host where a user can be induced to open a crafted workbook. The "network" vector reflects delivery of the weaponized file over the network, not necessarily a remotely reachable listening service.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-97762; the attack chain below is inferred strictly from the vulnerability class (out-of-bounds write) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies targets that use Microsoft Excel and that routinely open externally sourced spreadsheets (finance, HR, procurement, operations). Delivery addresses are harvested or guessed; no special network exposure beyond normal email/web/file-share reachability is required.

2. Triggering the flaw. The attacker crafts a malicious Excel workbook containing data structures that cause Excel's parser to write past the bounds of an internal buffer. Based on the CWE-787 classification, the trigger is a memory-safety violation during document processing — not an authentication bypass or an injection into a query language. The victim must open the file (UI:R), at which point Excel parses the malformed content and performs the out-of-bounds write.

3. Payload / execution method (class-level). An out-of-bounds write can corrupt adjacent memory. At the vulnerability-class level, the standard objective is to leverage the corruption to divert control flow and execute attacker-supplied code in the context of the Excel process (and therefore the logged-in user). The exact corruption primitive, offset, and control-flow target are not disclosed and are not speculated here. The CVSS ratings (C:H/I:H/A:H) indicate that code execution or equivalent high-impact compromise is the expected outcome if the flaw is successfully exploited.

4. Post-exploitation impact. Because scope is unchanged (S:U), the compromise is confined to the security authority of the vulnerable Excel process and the user running it. From that foothold an attacker could read or modify data accessible to that user, install additional tooling, and pursue lateral movement using the user's credentials and network access — subject to any application sandbox, Protected View, or endpoint controls in place.

Note: the availability of an in-the-wild exploit is not evidenced in the provided data; CISA KEV status is NO and no public exploit code has been observed.

Impact Assessment

The CVSS 3.1 base score of 8.8 (High) is driven by the following subscores:

• Attack Vector (AV:N): Exploitation can be delivered over a network; the attacker need not be locally present on the target host.
• Attack Complexity (AC:L): No special conditions or race windows are implied; the flaw is considered straightforward to trigger once the crafted document is opened.
• Privileges Required (PR:N): The attacker needs no credentials on the target.
• User Interaction (UI:R): A user must open the crafted document, which is the principal barrier to exploitation.
• Scope (S:U): The impact remains within the authorization scope of the vulnerable component.
• Confidentiality / Integrity / Availability (C:H/I:H/A:H): Successful exploitation is rated as causing high impact to all three.

Business impact: A single successful exploitation could yield code execution on an end-user workstation with the rights of the logged-in user. This can lead to data theft, document tampering, ransomware staging, or use of the host as a pivot. Because Excel is near-ubiquitous in enterprise environments and spreadsheet files are routinely exchanged with external parties, the effective blast radius is broad: every endpoint where Excel is installed and users open untrusted workbooks is a candidate target. The requirement for user interaction lowers the likelihood of fully automated, worm-like spread but does not reduce the severity of a successful compromise. Absent a patch, exposure persists until compensating controls (Protected View, ASR rules, attachment sandboxing) are enforced.

Detection Guidance

Sigma Rule

title: Suspicious Excel Child Process Indicative of Out-of-Bounds Write Exploitation
id: 7c4f1a2e-9d33-4f6b-b1a0-2f5e9d8c4a11
status: experimental
description: Detects Microsoft Excel spawning unusual child processes such as script interpreters or living-off-the-land binaries, consistent with post-exploitation activity following a memory corruption flaw (CVE-2026-97762).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97762
author: valtersit.com
date: 2026/01/01
tags:
  - attack.execution
  - attack.t1203
  - cve.2026.97762
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\EXCEL.EXE'
  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_suspicious_child
falsepositives:
  - Legitimate Excel macros or add-ins invoking system utilities
level: high

YARA Rule

rule CVE_2026_97762_Excel_OOB_Write
{
    meta:
        description = "Heuristic detection for malicious Excel documents attempting to trigger an out-of-bounds write (CVE-2026-97762)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97762"
        tlp = "WHITE"

    strings:
        $ole = { D0 CF 11 E0 A1 B1 1A E1 }
        $zip = { 50 4B 03 04 }
        $xlsx = "[Content_Types].xml"
        $macro1 = "Auto_Open" ascii nocase
        $macro2 = "Workbook_Open" ascii nocase
        $macro3 = "AutoOpen" ascii nocase

    condition:
        ($ole at 0 or $zip at 0) and filesize < 10MB and
        (2 of ($macro*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-97762 Possible Excel Weaponized Document Exfiltration/Callback"; flow:established,to_server; content:"Microsoft Office Excel"; http_header; content:".xls"; http_uri; within:64; classtype:attempted-user; sid:202697762; rev:1; reference:cve,2026-97762;)

Note: CVE-2026-97762 is a client-side memory corruption flaw in a document parser, so reliable network-signature detection is limited. The rule above targets outbound HTTP activity in the context of an Excel process and should be tuned; behavioral endpoint detection (Sigma/EQL) is the primary control.

Elastic Detection

process where event.type == "start" and
  process.parent.name : "EXCEL.EXE" and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                  "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")

Splunk SPL Query

index=windows EventCode=1
| search ParentImage="*\\EXCEL.EXE"
| search Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe")
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, ParentImage, Image, CommandLine
| sort - last_seen

Wazuh OSSEC Rule

<group name="windows,sysmon,cve-2026-97762,">
  <rule id="100977" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">EXCEL.EXE</field>
    <field name="win.eventdata.image">cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe</field>
    <description>CVE-2026-97762: Excel spawned suspicious child process - possible post-exploitation activity</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or workaround is currently available in the tracked data. The following measures are compensating controls pending a vendor fix.

1) Immediate mitigations

• Enforce Microsoft Defender Application Guard for Office and Protected View so documents from the internet/intranet/email open in a sandboxed, read-only container.
• Enable Attack Surface Reduction (ASR) rules, particularly "Block Office applications from creating child processes," "Block Office applications from creating executable content," and "Block Win32 API calls from Office macros."
• Block or quarantine high-risk attachment types at the email gateway and web proxy; strip or sandbox untrusted spreadsheets received from external senders.
• Restrict users from opening files directly from network shares and removable media where policy permits.
• Apply least privilege: users should not operate as local administrators, limiting the impact of code running in the Excel process context.

2) Patch / upgrade steps

• Monitor the Microsoft Security Update Guide and Microsoft Office release notes for a security update referencing CVE-2026-97762.
• Once published, prioritize patch deployment to endpoints where Excel is exposed to untrusted documents (finance, executive assistants, shared mailboxes).
• Confirm the fixed build via the Office version channel in use (Current, Monthly Enterprise, Semi-Annual) and validate that the update supersedes prior builds.

3) Long-term hardening

• Maintain an inventory of Microsoft Office builds and enforce timely update rings.
• Deploy EDR with behavioral detections for Office-spawned child processes and anomalous memory behavior.
• Conduct user awareness training on opening untrusted attachments; caution alone is insufficient but reduces the UI:R trigger surface.
• Adopt file-content disarm and reconstruction (CDR) at the mail gateway to neutralize weaponized documents before delivery.

References

• NVD — CVE-2026-97762: https://nvd.nist.gov/vuln/detail/CVE-2026-97762
• CWE-787 (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html
• Microsoft Security Update Guide (monitor for advisory): https://msrc.microsoft.com/update-guide
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CISA Known Exploited Vulnerabilities Catalog (current status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

At the time of writing, no threat actor campaign, exploit-in-the-wild activity, or public proof-of-concept has been associated with CVE-2026-97762 in the tracked sources. CISA KEV status is NO and no EPSS score has been published.