This vulnerability, identified as CWE-822 (Untrusted Pointer Dereference), exists in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It allows an attacker to execute code locally by exploiting improper handling of pointers. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality, integrity, and availability with high impact. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation could lead to local code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction to exploit.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26112 to mitigate this vulnerability.