Microsoft
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- IT leaders should verify if Mac-based Microsoft Office users are running affected software versions.
- Businesses should confirm whether Mac Office users need to apply the available security updates.
Questions to ask IT
- Do we run Microsoft 365 Apps, Microsoft Office 2021, Microsoft Office 2024 and 1 more, and which versions?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 14 Nov?
Next steps
- Confirm whether this affects systems or suppliers in your estate
- The vulnerability involves a double free in Microsoft Office Excel that could be exploited over a network.
- The affected component is Microsoft Office Excel, with a confirmed CVE identifier CVE-2026-97772.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- A vulnerability in Microsoft Office Excel could allow an attacker to execute code over a network.
- Microsoft has released security updates for Office for Mac to address the vulnerability.
- Customers running non-Mac Microsoft Office software are not affected by this issue.
Read the original reportMicrosoft Security Update Guide RSS(opens in a new tab)
Products and services involved
- Microsoft 365 Apps93% match confidence · CVE-2026-97772
- Microsoft Office 202193% match confidence · CVE-2026-97772
- Microsoft Office 202493% match confidence · CVE-2026-97772
- Microsoft Office Online Server93% match confidence · CVE-2026-97772
Pulse
Last checked 31 Oct · Recheck overdue since 7 Nov 2026, 23:39 UK time · 2 quiet checks collapsed
- Story15 Oct 2026, 22:44 UK time · 15 Oct
Linked reporting from Microsoft Security Update Guide RSS (vendor psirt).
Read source (Microsoft Security Update Guide RSS)
1 entry so far. The timeline chart appears once this story has more history.
Sources
CVE-2026-97772 Microsoft Office Excel Remote Code Execution Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Double free in Microsoft Office Excel allows an unauthorised attacker to execute code over a network
- ProbableSummary fact75% confidence
Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft Office software do not need to take any action. See the [Release Notes](https://go.microsoft.com/fwlink/p/?linkid=831049) for more information and download links.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-97772