CVE-2026-81958: CWE-908: Use of Uninitialized Resource in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-81958 and classified under CWE-908 (Use of Uninitialized Resource), affects Microsoft Office Excel in Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker with local access to disclose sensitive information due to the use of an uninitialized resource. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability impacts multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed builds. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An unauthorized local attacker can disclose sensitive information due to the use of an uninitialized resource in Microsoft Excel. The impact is limited to confidentiality loss without integrity or availability impact. The attack requires local access and user interaction.

Microsoft has released an official fix for this vulnerability. Since this is a cloud-hosted service, Microsoft manages the remediation on the server side. Users and administrators should apply the official updates as provided by Microsoft. No additional mitigation actions are indicated by the vendor advisory.