This vulnerability, identified as CVE-2026-81401 and classified under CWE-843 (Access of Resource Using Incompatible Type), affects Microsoft Office Excel within Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to locally disclose information due to a type confusion error. The CVSS v3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

An unauthorized local attacker can exploit this type confusion vulnerability to disclose sensitive information on the affected system. The impact is limited to confidentiality, with no integrity or availability impact reported. The attack requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81401 to mitigate this vulnerability.