CVE-2026-81386: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81386) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally by exploiting the overflow condition. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The affected versions include multiple version ranges prior to fixed builds, such as >=16.0.0 <16.0.5569.1003 and others as listed. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation of this heap-based buffer overflow could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as provided in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81386). Since this is a cloud-hosted service, Microsoft manages remediation server-side. Check the vendor advisory for the latest patch status and deployment guidance.