This vulnerability (CVE-2026-50675) involves a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally if the user interacts with a crafted file or content. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and no privileges required but user interaction needed. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation can lead to local code execution with high impact on confidentiality, integrity, and availability of the affected system. The attacker does not require privileges but needs user interaction to trigger the vulnerability. This can result in full compromise of the affected application environment.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50675. No additional user action is required beyond applying the official update.