CVE-2026-81957: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, tracked as CVE-2026-81957 and classified under CWE-125 (Out-of-bounds Read), exists in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to perform an out-of-bounds read that can lead to local code execution. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability affects multiple version ranges of Microsoft 365 Apps for Enterprise prior to the fixed versions. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute code locally with high impact on confidentiality, integrity, and availability. This could lead to full compromise of the affected system where the vulnerable Microsoft 365 Apps for Enterprise version is installed.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81957. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation actions are required beyond applying the official update.