CVE-2026-108446: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108446) is a use-after-free issue classified under CWE-416 affecting Microsoft Office Excel in Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. The vendor has released an official patch to address this issue. The affected versions include multiple ranges within version 16.0 and earlier builds as specified. The vulnerability is publicly disclosed and tracked by Microsoft with a vendor advisory available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely without requiring user privileges, potentially leading to full compromise of the affected system. The impact affects confidentiality, integrity, and availability of the system running the vulnerable Microsoft 365 Apps for Enterprise Excel component.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided patches as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108446. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No known exploits are currently active in the wild.