CVE-2026-81949: CWE-190: Integer Overflow or Wraparound in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-81949, involves an integer overflow or wraparound issue in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and complete impact on confidentiality, integrity, and availability. Multiple affected version ranges are documented, and Microsoft has issued an official fix. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81949.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally on the affected system, resulting in full compromise of confidentiality, integrity, and availability of the system. This can lead to unauthorized data access, modification, or disruption of service within Microsoft 365 Apps for Enterprise environments.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81949. Since this is a cloud-hosted service, Microsoft manages remediation server-side for cloud instances. No additional mitigation steps are required beyond applying the official patch.