CVE-2026-81948: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81948) is a heap-based buffer overflow in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables local code execution by an unauthorized attacker. The flaw affects multiple versions of the product prior to fixed versions. The CVSS 3.1 score is 7.8, indicating high severity with impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability and provides advisory guidance on their update guide.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system. The impact includes high confidentiality, integrity, and availability consequences as per the CVSS vector. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81948. Since this is a cloud-managed service, Microsoft manages remediation for cloud-hosted components. No additional mitigation steps are indicated by the vendor advisory.