cve-2026-81951

CVE-2026-81951 is a Critical heap-based buffer overflow in Microsoft Excel addressed in Microsoft's September 24, 2026 security release. The vulnerability affects supported Microsoft 365 Apps, Office 2016, Office 2019, Office LTSC releases, and Office for Mac, and successful exploitation requires a recipient to open a malicious Office file, after which code can execute locally with high impact to confidentiality, integrity, and availability. Microsoft rates exploitation less likely, but the wide install base of Excel makes verifying the product-specific fixed build or KB update a practical priority for administrators and end users tracking this CVE.