CVE-2026-32188 is an out-of-bounds read vulnerability (CWE-125) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. The vulnerability permits an unauthorized attacker to perform a local information disclosure by reading memory outside the intended bounds. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality and availability but not integrity. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected version explicitly identified is 16.0.1.

Successful exploitation of this vulnerability could allow an unauthorized local attacker to disclose sensitive information from memory. The impact affects confidentiality (high) and availability (high) but does not affect integrity. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188 to ensure their Microsoft 365 Apps for Enterprise environment is updated and protected. No additional user action is required beyond applying the official fix.