This vulnerability (CVE-2026-44822) involves an out-of-bounds read in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables an unauthenticated attacker to remotely disclose sensitive information by exploiting improper memory access. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Microsoft has released an official fix and manages patching for this cloud service. No known exploits are reported in the wild as of the publication date.

Successful exploitation can lead to unauthorized disclosure of sensitive information over the network. The integrity and availability impacts are low or none, but confidentiality impact is high. This could expose confidential data to attackers without requiring authentication or user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44822. No additional mitigation actions are required beyond applying the official fix.