This vulnerability is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, resulting in complete compromise of the affected system's confidentiality, integrity, and availability.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58618 to mitigate this vulnerability.