CVE-2026-88145: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88145) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The vulnerability has been assigned a CVSS v3.1 score of 8.8, indicating high severity, with impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this issue and manages remediation for this cloud-hosted service. The affected versions include =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, and =16.0.0.

Successful exploitation of this heap-based buffer overflow can lead to remote code execution with high impact on confidentiality, integrity, and availability of the affected system. The attacker does not require privileges and can execute code remotely, potentially compromising the affected environment.

An official fix is available from Microsoft. Users and administrators should apply the provided patches promptly. Since this is a cloud-hosted service, Microsoft manages remediation server-side; verify that updates have been applied by consulting the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88145.