This vulnerability involves an out-of-bounds read (CWE-125) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise version 16.0.1. It permits an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS 3.1 vector indicates the attack requires local access with low attack complexity and no privileges, but user interaction is required. The confidentiality impact is high, while integrity and availability are not affected. Microsoft has published an official fix and manages remediation for this cloud service.

Successful exploitation could lead to unauthorized local disclosure of sensitive information from memory due to the out-of-bounds read. There is no impact on integrity or availability. No known exploits are currently reported in the wild.

An official fix is available from Microsoft, and remediation is managed by the vendor for this cloud-hosted service. Users and administrators should apply the official update as provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21261 to address this vulnerability.