This vulnerability in Microsoft Data Formulator arises from improper control over code generation, enabling remote code execution by an attacker without privileges and requiring user interaction. The CVSS vector indicates the attack can be performed over the network with low attack complexity and no privileges required, but user interaction is necessary. The impact affects confidentiality, integrity, and availability at a high level. Microsoft has released an official fix to remediate this vulnerability as detailed in their security advisory.

Successful exploitation allows an attacker to execute arbitrary code remotely on affected systems, potentially leading to full compromise of confidentiality, integrity, and availability of the system running Microsoft Data Formulator. This can result in unauthorized access, data manipulation, and service disruption.

An official fix is available from Microsoft. Users and administrators should apply the provided security update from the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41094 promptly to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.