This vulnerability involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise, which could allow an unauthorized local attacker to disclose sensitive information. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no privileges, but user interaction is required. The impact includes high confidentiality and availability impact but no integrity impact. Microsoft has acknowledged the issue and provided an official fix. The product is a cloud service, and Microsoft manages remediation for this service.

An attacker with local access and the ability to trick a user into interacting with a malicious file could exploit this vulnerability to read memory outside the intended bounds, potentially disclosing sensitive information. The vulnerability does not affect integrity but has high confidentiality and availability impacts. There are no known exploits in the wild currently.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided update from Microsoft to remediate this issue. Since this is a cloud service, Microsoft manages remediation server-side; users should verify that their Microsoft 365 Apps for Enterprise installations are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188.