This vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is officially fixed by Microsoft, who manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

Successful exploitation allows an attacker to execute arbitrary code locally, resulting in full compromise of the affected system's confidentiality, integrity, and availability. This can lead to unauthorized access, data manipulation, or denial of service on the affected endpoint running Microsoft 365 Apps for Enterprise version 16.0.1.

An official fix is available from Microsoft. Microsoft manages remediation for this cloud-hosted service, and users should apply the update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58618. No additional mitigation steps are required beyond applying the official patch.