This vulnerability (CVE-2026-68801) is a heap-based buffer overflow in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise, identified as CWE-122. It enables an unauthorized attacker to execute arbitrary code locally. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected version is 16.0.1.

Successful exploitation allows an attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The vulnerability requires local access and user interaction to exploit.

An official fix is available from Microsoft. Users of Microsoft 365 Apps for Enterprise version 16.0.1 should apply the update provided by Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68801 for detailed patching instructions.