This vulnerability involves an out-of-bounds read (CWE-125) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. It permits an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS 3.1 base score is 5.5, reflecting local attack vector, low attack complexity, no privileges required, and user interaction needed. The confidentiality impact is high, with no impact on integrity or availability. Microsoft has published an official fix and manages remediation for this cloud service.

An attacker can exploit this vulnerability to disclose sensitive information locally on the affected system. There is no impact on data integrity or system availability. Exploitation requires local access and user interaction. No known exploits are currently in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68813 to ensure the fix is applied.