This vulnerability (CVE-2026-81958) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise arises from the use of an uninitialized resource, which may lead to local information disclosure by an unauthorized attacker. The CVSS 3.1 base score is 5.5 (medium), with attack vector local, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An unauthorized local attacker could disclose sensitive information due to the use of an uninitialized resource in Microsoft Excel. The impact is limited to confidentiality; integrity and availability are not affected. Exploitation requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81958.