This vulnerability (CVE-2026-44822) is an out-of-bounds read flaw in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. It allows an attacker without privileges or user interaction to potentially disclose sensitive information remotely. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with limited integrity impact. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker can remotely exploit this vulnerability to read memory outside the intended bounds, potentially disclosing sensitive information. The impact is primarily on confidentiality with no reported impact on availability and limited impact on integrity. This could lead to unauthorized information disclosure over a network.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44822 for detailed patch and update instructions and ensure their Microsoft 365 Apps for Enterprise environment is updated accordingly.