CVE-2026-81388: CWE-121: Stack-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability is a stack-based buffer overflow (CWE-121) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally by exploiting the overflow condition. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges, and user interaction. The impact includes high confidentiality, integrity, and availability consequences. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected versions span multiple version ranges prior to the fixed builds.

Successful exploitation allows local code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.8, indicating significant risk if exploited.

An official fix is available from Microsoft to address this vulnerability. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81388. Since this is a cloud service, Microsoft manages remediation server-side, but local clients must be updated to the fixed versions to prevent exploitation.