CVE-2026-81951: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-81951 is a heap-based buffer overflow vulnerability identified in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The vulnerability permits an unauthorized attacker to execute code locally by exploiting the overflow condition. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected application and system. The vulnerability requires local access and user interaction to exploit.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81951. Since this is a cloud-hosted service, Microsoft manages remediation for the cloud environment. No additional mitigation actions are specified by the vendor.