This vulnerability (CVE-2026-32188) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to perform local information disclosure. The CVSS 3.1 score is 7.1, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An attacker can cause an out-of-bounds read leading to local information disclosure. The impact includes high confidentiality loss and high availability impact, but no integrity impact. This could expose sensitive information to unauthorized users on the local system.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188.