CVE-2026-97770

Executive Summary

CVE-2026-97770 is a stack-based buffer overflow (CWE-121) in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code over a network. The vulnerability carries a CVSS 3.1 base score of 8.8 (High), reflecting network reachability, low attack complexity, no required privileges, and high confidentiality, integrity, and availability impact — tempered only by the requirement for user interaction. No public proof-of-concept, exploit code, or Nuclei template is currently available, and no vendor patch has been identified from any tracked source, leaving affected Excel deployments unpatched.

Technical Analysis

CVE-2026-97770 is classified as a stack-based buffer overflow (CWE-121). This class of defect occurs when a program writes more data to a fixed-length buffer allocated on the call stack than the buffer can hold. Because the stack holds control-flow-critical data — saved base pointers and return addresses — an overflow can overwrite those values and redirect execution to attacker-supplied code or other attacker-controlled memory.

Per the NVD description, the vulnerable component is Microsoft Office Excel, and the flaw is remotely triggerable ("execute code over a network"). In the Office/Excel context, remote network delivery typically means the attacker supplies a crafted document (for example, a spreadsheet file) hosted on or delivered through a network-reachable channel, and the victim opens it in Excel. The CNA title and vendor advisory fields are empty in the supplied intelligence, so no specific vulnerable function, parser routine, file format record, or memory-corruption primitive can be confirmed. What can be stated factually from the data is:

• Vulnerability class: Stack-based buffer overflow (CWE-121), a memory-safety defect.
• Attack vector: Network (AV:N) — the crafted input can traverse a network path.
• Preconditions: No privileges required (PR:N), low complexity (AC:L), but user interaction is required (UI:R) — the victim must perform an action (consistent with opening or interacting with a malicious document).
• Impact scope: Unchanged (S:U) — exploitation affects the Excel process and its host context, not an additional security authority beyond the vulnerable component's privileges.
• Result: Successful exploitation yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H), i.e., arbitrary code execution in the context of the running Excel process.

No information is available to confirm which Excel component (e.g., a specific file parser, formula engine, or embedded-object handler) contains the faulty buffer, and no public analysis describes the exact bytes or record structure required to trigger the overflow. Analysts should treat the trigger format and precise offset as unknown and not assume any particular file construct beyond "a network-delivered input processed by Excel."

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (stack-based buffer overflow) and the NVD description ("allows an unauthorized attacker to execute code over a network").

1. Reconnaissance / target identification. The attacker identifies users or organizations running unpatched Microsoft Office Excel. Because the flaw is reachable over a network (AV:N), the attacker does not need local access or credentials; they need a delivery channel to the victim (email, file share, or a web-hosted document the victim opens).

2. Trigger (vulnerability-class level). The attacker crafts an input document that, when processed by Excel, causes more data to be written to a fixed-size stack buffer than it can hold. The over-long value overwrites adjacent stack memory. The exact field, record, or construct that carries the oversized value is not specified in the available intelligence and must not be assumed.

3. Payload / execution (vulnerability-class level). By controlling the overflowing data, the attacker can overwrite stack-resident control data — typically a saved return address or pointer — to redirect execution. In the classic exploitation model, this leads to arbitrary code execution within the Excel process. Whether modern mitigations (e.g., stack cookies, ASLR, DEP) must be bypassed is not determinable from the provided data.

4. Post-exploitation impact. Given C:H/I:H/A:H, successful exploitation gives the attacker code execution in the context of the Excel process, enabling data theft, document tampering, persistence, and potential lateral movement subject to the privileges and network position of the Excel process (Unchanged scope).

Impact Assessment

• Confidentiality (C:H): Full loss of confidentiality within the affected component — attacker code can read data accessible to the Excel process.
• Integrity (I:H): Full loss of integrity — attacker can modify data and documents.
• Availability (A:H): Full loss of availability — attacker can disrupt or crash the process/service.
• Base score: 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
• Blast radius: Any environment where users open network-delivered Excel documents. Because UI:R is required, mass exploitation relies on social engineering or automated document delivery. Endpoints handling sensitive spreadsheets (finance, HR, engineering) are highest risk.
• Exploitability context: EPSS has not yet been scored by FIRST.org — no exploitation-probability estimate is available. CISA KEV: NO. No observed threat-actor campaigns or in-the-wild exploitation are evidenced in the supplied data.

Detection Guidance

Sigma Rule

title: Suspicious Excel Child Process Spawning (Potential Code Execution)
id: 8f3c1a2e-9777-4b0e-9a1c-excel-cve-2026-97770
status: experimental
description: Detects Microsoft Excel spawning unexpected child processes, which may indicate code execution following exploitation of a memory-corruption vulnerability such as CVE-2026-97770.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97770
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\EXCEL.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
falsepositives:
  - Legitimate Excel macros or add-ins invoking shells (rare in hardened environments)
level: high

YARA Rule

rule EXPL_Office_Excel_StackOverflow_CVE_2026_97770
{
    meta:
        description = "Heuristic detection for Office/Excel documents exhibiting anomalous embedded executable markers or oversized structures potentially associated with stack-based buffer overflow exploitation (CVE-2026-97770)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97770"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ole = { D0 CF 11 E0 A1 B1 1A E1 }
        $zip_pk = { 50 4B 03 04 }
        $mz = { 4D 5A }
        $pe = { 50 45 00 00 }
        $macro1 = "Auto_Open" ascii nocase
        $macro2 = "Workbook_Open" ascii nocase
        $shell1 = "Shell" ascii wide
        $shell2 = "CreateObject" ascii wide
        $shell3 = "WScript.Shell" ascii wide nocase

    condition:
        (uint16(0) == 0xCFD0 or uint32(0) == 0x04034B50) and
        (
            (any of ($macro1, $macro2) and any of ($shell1, $shell2, $shell3))
            or
            (any of ($mz, $pe))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"EXPLOIT Possible Microsoft Office Excel Stack Buffer Overflow Delivery (CVE-2026-97770)"; flow:established,to_client; file_data; content:"|D0 CF 11 E0 A1 B1 1A E1|"; offset:0; depth:8; content:"Excel"; nocase; http.header; filestore; sid:9777001; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_97770; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97770;)

alert smtp any any -> any any (msg:"EXPLOIT Microsoft Excel Spreadsheet Attachment Delivery (CVE-2026-97770)"; flow:established,to_client; file_data; content:"|50 4B 03 04|"; offset:0; depth:4; fileext:"xlsx"; filestore; sid:9777002; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_97770; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97770;)

Elastic Detection

process where event.type == "start" and
  process.parent.name : "excel.exe" and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                  "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")

Splunk SPL Query

index=windows EventCode=1
| search ParentImage="*\\EXCEL.EXE"
| search Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines by Computer, User, ParentImage, Image
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="windows,sysmon,exploit,">
  <rule id="977700" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">EXCEL.EXE$</field>
    <field name="win.eventdata.image">(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe)$</field>
    <description>Possible exploitation of CVE-2026-97770: Microsoft Excel spawned a suspicious child process</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_97770,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Enforce the principle of least privilege so that Excel does not run with elevated rights.
   • Block or quarantine network-delivered Office documents from untrusted senders/sources (email gateways, web proxies, file-share policies).
   • Disable macros and ActiveX by default; restrict embedded-object handling in Office Trust Center.
   • Apply Microsoft Defender Attack Surface Reduction (ASR) rules, including "Block Office applications from creating child processes" and "Block Office applications from injecting code into other processes."
   • Enable Windows exploit mitigations (DEP, ASLR, CFG) to raise the cost of memory-corruption exploitation.

2. Patch/upgrade steps

   • Monitor the NVD record and Microsoft security advisories for an official fix; no patch is currently available.
   • As soon as a vendor update ships, validate and deploy to all Excel installations via the organization's patch-management workflow.

3. Long-term hardening

   • Maintain a Software Bill of Materials (SBOM) for productivity software to rapidly identify exposure when a fix is released.
   • Reduce the attack surface by enforcing Protected View for documents from the internet.
   • Deploy endpoint detection with the process-lineage monitoring above.
   • Conduct ongoing user awareness training on malicious-document delivery.

References

• NVD — CVE-2026-97770: https://nvd.nist.gov/vuln/detail/CVE-2026-97770
• CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• MITRE ATT&CK — T1203 Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• FIRST — EPSS (currently unscored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-97770 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns, exploit-in-the-wild evidence, or public PoC are identified in the supplied intelligence for CVE-2026-97770.