CVE-2026-81953: CWE-121: Stack-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-81953 is a stack-based buffer overflow vulnerability (CWE-121) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally. The vulnerability has a CVSS 3.1 base score of 7.8 (high severity) with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Multiple version ranges prior to fixed builds are affected. Microsoft has issued an official fix and manages remediation for this cloud service. No known active exploitation has been reported.

Successful exploitation allows local code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could enable execution of arbitrary code with the privileges of the user running Excel.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81953. Since this is a cloud-hosted service, Microsoft manages remediation for the cloud environment. No additional action is required beyond applying the official patches.