This vulnerability involves an integer underflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise, which can lead to an out-of-bounds read condition. Exploitation of this flaw may allow an unauthorized attacker to execute code locally. The CVSS 3.1 vector indicates local attack vector with low attack complexity, no privileges required, and user interaction needed. The impact includes high confidentiality, integrity, and availability impacts. Microsoft has released an official fix and manages remediation for this cloud-hosted service. The affected version explicitly stated is 16.0.1.

Successful exploitation can result in local code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.8, reflecting significant impact if exploited.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44820. No additional action is required beyond applying the official fix.