This vulnerability, tracked as CVE-2026-20955 and classified under CWE-822 (Untrusted Pointer Dereference), affects Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It allows an attacker to execute code locally by exploiting improper handling of pointers. The CVSS 3.1 score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service. The affected version explicitly identified is 16.0.1.

Successful exploitation could lead to local code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction to exploit. No known exploits have been reported in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20955 to ensure their environments are updated and protected.