This vulnerability involves an integer underflow (numeric truncation error) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. The flaw could be exploited by an unauthorized attacker to execute code locally. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the critical nature of the impact if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44823 to mitigate this vulnerability.