CVE-2026-97765

Executive Summary

CVE-2026-97765 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network. The vulnerability carries a CVSS 3.1 base score of 8.8 (High), reflecting a network-reachable attack path that requires user interaction but yields full confidentiality, integrity, and availability impact within the exploited component's security scope. Because no patch has been identified by any tracked source and no public proof-of-concept or exploit code exists, the immediate risk is characterized by a dangerous combination: high theoretical impact with no available remediation artifact and limited public detection coverage.

Technical Analysis

The NVD description states that this is a heap-based buffer overflow in Microsoft Office Excel allowing an unauthorized attacker to execute code over a network. CWE-122 is the assigned weakness class.

A heap-based buffer overflow occurs when a program writes more data to a buffer allocated on the heap than that buffer can hold, corrupting adjacent heap metadata or object data. In the context of a document-parsing application such as a spreadsheet program, this class of defect typically arises during the parsing of a malformed input (for example, a crafted file structure, embedded object, or field length) where a length value is trusted and used to size or copy into a heap allocation without adequate bounds validation. The corrupted heap state can then be leveraged to influence the program's control flow and achieve arbitrary code execution in the context of the application process.

The attack surface is the document/file parsing path of Microsoft Office Excel. Because the description specifies "over a network," delivery may occur through any channel that supplies an Excel document to a victim — including email attachments, web-hosted files, or shared/network locations — but the precise delivery vector is not enumerated in the available data.

Important limitations of the available intelligence: the CNA title is empty, affected version ranges are not specified, OSV package data is absent, and no patch information exists from any tracked source. Consequently, the specific parsing component, the exact malformed structure that triggers the overflow, and the precise condition under which the heap write exceeds its allocation cannot be determined from the data provided. No function names, class names, file paths, or parameter names are supplied in the NVD description, and none are asserted here.

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates:

• AV:N — reachable over a network.
• AC:L — no special conditions beyond those implied by user interaction.
• PR:N — no privileges required by the attacker.
• UI:R — successful exploitation requires a user to perform an action (consistent with opening or interacting with a crafted document).
• S:U — impact is confined to the vulnerable component's security scope.
• C:H/I:H/A:H — full loss of confidentiality, integrity, and availability upon successful exploitation.

The combination of PR:N and UI:R is characteristic of a client-side document exploitation scenario: the attacker needs no credentials, but must persuade a user to open or interact with a malicious document.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-97765; the attack chain below is therefore described at the vulnerability-class level and inferred from the CWE-122 class and the NVD description. It does not assert specific implementation details.

1. Reconnaissance / target identification An attacker identifies targets that use Microsoft Office Excel and are reachable through a network-delivered document workflow (email, web download, or shared file location). Because no affected version range is published, the attacker cannot scope a precise version fingerprint from this advisory alone and would rely on broad targeting of Excel users.

2. Triggering the flaw The attacker crafts a document containing a structure that causes Excel's parser to write beyond the bounds of a heap-allocated buffer (CWE-122). The exact malformed element is not specified in the available intelligence; at the class level, the trigger is a length or size mismatch during parsing that is not validated against the destination heap allocation.

3. Delivery and user interaction Consistent with UI:R, the crafted document must be opened or acted upon by the victim. Delivery over a network (consistent with AV:N) may use email attachments, links to hosted files, or shared network paths. No specific delivery mechanism is confirmed by the data.

4. Post-exploitation impact Successful corruption of heap memory can enable control-flow manipulation and code execution in the context of the Excel process (C:H/I:H/A:H). The scope is unchanged (S:U), meaning the direct impact is assessed against the vulnerable component rather than assumed to cross a security boundary automatically. Any escalation beyond that boundary would depend on additional factors not established by this advisory.

Note: Because PoC status is None and no exploit code is tracked, there is no evidence of weaponization or in-the-wild exploitation in the provided data. CISA KEV status is NO.

Impact Assessment

The CVSS base score of 8.8 places this in the High severity band. Full C/I/A impact means that a successful exploit could result in unauthorized code execution, data disclosure, data tampering, and denial of service within the affected application's context. The PR:N/UI:R combination means exploitation is gated by user interaction rather than by credentials, which is typical of client-side document attacks and is mitigated primarily through user behavior, email/web filtering, and endpoint controls.

Blast radius considerations:

• Any environment where users open Excel documents from untrusted or external sources is potentially exposed.
• Because affected version ranges are unknown, organizations cannot perform precise version-based scoping and should assume broad potential exposure across deployed Excel/Office builds until vendor guidance is available.
• The absence of a patch (patch confidence 0/4) and the absence of a public PoC both shape risk: there is no confirmed exploitable tooling in the wild, but there is also no vendor fix to deploy. This asymmetry means compensating controls carry the full mitigation burden.

Detection Guidance

Sigma Rule

title: Potential Microsoft Excel Heap Overflow Exploitation (CVE-2026-97765)
id: 8f2a1c74-9d3e-4b21-9a6f-0c5e77b1a2d9
status: experimental
description: Detects Office Excel child processes or network-delivered documents exhibiting behavior consistent with client-side exploitation of a heap-based buffer overflow in Excel.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97765
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\EXCEL.EXE'
  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_suspicious_child
falsepositives:
  - Legitimate Excel macros spawning command interpreters (rare)
  - Software installers using Excel automation
level: high
tags:
  - attack.t1203
  - cve.2026.97765

YARA Rule

rule EXPL_Office_HeapOverflow_CVE_2026_97765
{
    meta:
        description = "Heuristic detection of Excel documents with anomalous structures potentially related to CVE-2026-97765 heap-based buffer overflow"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97765"
        severity = "high"

    strings:
        $ole = { D0 CF 11 E0 A1 B1 1A E1 }
        $zip = { 50 4B 03 04 }
        $xls = ".xls" ascii nocase
        $xlsx = ".xlsx" ascii nocase
        $macro1 = "Auto_Open" ascii nocase
        $macro2 = "Workbook_Open" ascii nocase

    condition:
        (uint16(0) == 0xD0CF or uint16(0) == 0x4B50) and
        ($xls or $xlsx or $ole or $zip) and
        ($macro1 or $macro2)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"EXPLOIT Possible Microsoft Excel Heap Overflow Exfiltration CVE-2026-97765"; flow:established,to_server; content:"|50 4B 03 04|"; depth:4; content:".xls"; nocase; http_header; classtype:attempted-user; reference:cve,2026-97765; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-97765; sid:90097765; rev:1;)

Elastic Detection

process where process.parent.name == "EXCEL.EXE" and
process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where match(ParentProcessName, "(?i)EXCEL\\.EXE$")
| where match(NewProcessName, "(?i)(cmd\\.exe|powershell\\.exe|wscript\\.exe|cscript\\.exe|mshta\\.exe|rundll32\\.exe|regsvr32\\.exe)$")
| stats count values(NewProcessName) as child_processes by ComputerName, UserName, ParentProcessName
| where count > 0

Wazuh OSSEC Rule

<group name="windows,office,cve-2026-97765,">
  <rule id="100765" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">EXCEL\.EXE$</field>
    <field name="win.eventdata.image">(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe)$</field>
    <description>CVE-2026-97765: Suspicious child process spawned by Microsoft Excel - possible heap overflow exploitation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_97765,attack_exploitation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data is available. The guidance below is class-based and must be validated against official vendor advisories when they become available.

1. Immediate mitigations (compensating controls, since no patch exists):

• Enforce email and web gateway inspection that blocks or sandboxes untrusted Excel documents from external senders and sources.
• Apply Mark-of-the-Web / Protected View and disable automatic content execution for documents originating from the internet.
• Restrict Excel from launching child processes using Windows Defender Application Control or AppLocker rules that block script interpreters and command shells from spawning as children of EXCEL.EXE.
• Enable Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from creating executable content.
• Segment and monitor shared/network locations where spreadsheet files are distributed.
• Educate users to avoid opening unsolicited spreadsheet attachments.

2. Patch/upgrade steps:

• Monitor the Microsoft Security Response Center and Microsoft Office update channels for an advisory and security update referencing CVE-2026-97765.
• When a fix is published, inventory Excel/Office installations, prioritize externally exposed and high-value users, and deploy the update through standard patch management. Because affected versions are unknown, treat this as broad-scope until vendor guidance clarifies the impacted builds.
• Validate post-patch that the vulnerable parsing behavior is remediated in regression testing.

3. Long-term hardening:

• Maintain an inventory of Office versions and update rings with automated vulnerability correlation.
• Adopt controlled-folder access and application allowlisting to reduce post-exploitation impact.
• Deploy EDR with heap-corruption and exploit-mitigation telemetry (for example, CFG/ACG/Segment Heap signals where supported) and tune detections for Office-spawned child processes.
• Continuously monitor EPSS and KEV for changes; EPSS is currently unscored and CISA KEV status is NO.

References

• NVD — CVE-2026-97765: https://nvd.nist.gov/vuln/detail/CVE-2026-97765
• MITRE CWE-122 (Heap-based Buffer Overflow): https://cwe.mitre.org/data/definitions/122.html
• FIRST EPSS (currently unscored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-97765 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Microsoft Security Response Center (monitor for advisory/patch): https://msrc.microsoft.com/update-guide

Threat actor / campaign note: No threat actor attribution, exploit-in-the-wild evidence, or campaign data is available in the provided intelligence. CISA KEV status is NO and no public PoC or exploit code is tracked at this time.