This vulnerability (CVE-2026-26108) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1. Microsoft has issued an official fix and manages remediation for the cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of the impacted Microsoft 365 Apps for Enterprise environment. The impact includes high confidentiality, integrity, and availability consequences.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per Microsoft's guidance in the advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26108.