Main Vulnerability Database Vulnerabilities #VU155600

Integer overflow in Office Online Server and Microsoft Office - CVE-2026-97778

Published: October 14, 2026

Vulnerability identifier: #VU155600

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-97778

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

Affected software

Office Online Server
Microsoft Office

How to mitigate CVE-2026-97778

Install security update from vendor's website.

Office Online Server - update to 16.0.10417.20228
Microsoft Office - addressed in versions 16.0.14334.20974, 16.0.17932.21056

External References

Related Security Bulletins