This vulnerability (CVE-2026-21259) involves a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise version 16.0.1. The flaw enables an unauthorized attacker with local access to elevate privileges. The CVSS 3.1 score of 7.8 reflects high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

Successful exploitation allows an unauthorized local attacker to elevate privileges, potentially gaining higher access rights on the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. No active exploits are currently known.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21259. No additional user action is required beyond applying the official update.