This vulnerability (CVE-2026-81947) is a heap-based buffer overflow in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. The flaw enables an unauthorized attacker to execute code locally, potentially leading to full compromise of the affected system. The CVSS v3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation allows unauthorized local code execution, which can compromise confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction but no privileges, making it a significant local threat. Since the product is cloud-hosted, the vendor handles patching and mitigation server-side.

An official fix is available from Microsoft. Because this is a cloud-hosted service, Microsoft manages remediation and patch deployment. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81947.