This vulnerability (CVE-2026-68805) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It enables an unauthorized attacker to execute code locally, potentially compromising system confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, indicating a high severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix and manages remediation for this cloud service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68805.

Successful exploitation of this heap-based buffer overflow can lead to local code execution by an unauthorized attacker, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction but no privileges, making it a significant risk if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68805.