CVE-2026-81391: CWE-908: Use of Uninitialized Resource in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81391) arises from the use of an uninitialized resource in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker with local access to disclose sensitive information. The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, user interaction required, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An unauthorized attacker with local access and user interaction can exploit this vulnerability to disclose sensitive information from the affected Microsoft Office Excel component. The impact is limited to confidentiality with no integrity or availability effects. There are no known active exploits in the wild.

An official fix is available from Microsoft. The vendor manages remediation for this cloud-hosted service. Users and administrators should apply the official updates as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81391 to mitigate this vulnerability.