CVE-2026-81956: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-81956 is an out-of-bounds read vulnerability (CWE-125) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. This vulnerability enables an unauthorized attacker to execute code locally by exploiting the memory safety issue. The CVSS 3.1 base score is 7.8 (high severity) with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Multiple version ranges of Microsoft 365 Apps for Enterprise are affected, with fixed versions starting at 16.0.20326.20138 and others as specified. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits in the wild have been reported as of the publication date.

Successful exploitation allows an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires local access and user interaction but does not require privileges, increasing the risk if a user opens a malicious Excel file.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81956. Since this is a cloud-hosted service, Microsoft manages remediation server-side for cloud components. No additional mitigation steps are specified by the vendor.