CVE-2026-20950 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. This vulnerability enables an unauthorized attacker to execute arbitrary code locally by exploiting the use-after-free condition. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. The affected version explicitly identified is 16.0.1. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the impacted environment. This can result in unauthorized actions being performed with the privileges of the user running the application.

An official fix is available from Microsoft for this vulnerability. Microsoft manages remediation for this cloud-hosted service, and users should apply the provided updates as directed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20950. No additional mitigation steps are required beyond applying the official patch.