CVE-2026-81950: CWE-415: Double Free in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-81950 is a double free vulnerability (CWE-415) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. The flaw allows an unauthorized attacker to execute code locally, potentially leading to full compromise of the affected system. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to the fixed builds indicated. The CVSS 3.1 base score is 7.8, reflecting high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits have been reported in the wild.

Successful exploitation of this double free vulnerability allows an unauthorized attacker to execute arbitrary code locally on the affected system. This can lead to full compromise of confidentiality, integrity, and availability of the affected Microsoft 365 Apps for Enterprise installation. The vulnerability requires local access and user interaction but does not require privileges. No known active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81950. Since this is a cloud-hosted service, Microsoft manages remediation on their side. There are no additional mitigations required beyond applying the official patch.