This vulnerability (CVE-2026-50678) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information locally. The CVSS 3.1 base score is 6.6, reflecting local attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker can exploit this heap-based buffer overflow to disclose information on a local system running the affected version of Microsoft 365 Apps for Enterprise. The impact includes partial loss of confidentiality and integrity, and a high impact on availability. However, exploitation requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50678 to mitigate this vulnerability.