This vulnerability (CVE-2026-20956) is classified as CWE-822: Untrusted Pointer Dereference in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally by exploiting improper handling of pointers. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has released an official fix and manages remediation for this cloud service.

Successful exploitation allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected application environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure that Microsoft 365 Apps for Enterprise is updated to the fixed version as per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20956.