The vulnerability CVE-2026-41094 in Microsoft Data Formulator is due to improper control of code generation, enabling unauthorized remote code execution. This code injection flaw allows attackers to execute arbitrary code over a network without privileges, requiring only user interaction. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for version 1 of the product, as detailed in their security advisory.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected systems, leading to full compromise of confidentiality, integrity, and availability of the impacted environment. The vulnerability requires no privileges and low attack complexity but does require user interaction.

An official fix is available from Microsoft. Users and administrators should apply the provided patch for Microsoft Data Formulator version 1 promptly. Refer to the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41094 for detailed remediation instructions.