This vulnerability (CVE-2026-78518) is an out-of-bounds read (CWE-125) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1 of Microsoft 365 Apps for Enterprise. Microsoft has provided an official fix and manages remediation for this cloud-hosted service. No active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the targeted environment. The vulnerability requires user interaction but no privileges or authentication, increasing the risk of exploitation in networked environments.

An official fix is available from Microsoft. Since this vulnerability affects a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78518 to ensure their Microsoft 365 Apps for Enterprise environment is updated and protected. No additional mitigation actions are required beyond applying the official fix.