This vulnerability (CVE-2026-20957) involves an integer underflow (wrap or wraparound) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally on the affected system. The vulnerability has been assigned a CVSS 3.1 base score of 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires local access and user interaction to trigger.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20957.