This vulnerability (CVE-2026-44820) involves an out-of-bounds read in Microsoft Excel within Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

Successful exploitation of this vulnerability can result in local code execution by an unauthorized attacker, leading to complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS vector indicates high impact on all three security properties. No known exploits are currently active in the wild.

An official fix is available from Microsoft for this vulnerability. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44820 to mitigate this vulnerability.