CVE-2026-32188 is an out-of-bounds read vulnerability (CWE-125) affecting Microsoft Office Excel in Microsoft 365 Apps for Enterprise version 16.0.1. The vulnerability permits an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high confidentiality and availability impact. Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. No known exploits have been reported.

Successful exploitation of this vulnerability can lead to local disclosure of sensitive information and impact availability. The confidentiality impact is high, meaning sensitive data could be exposed. The integrity impact is none, so data modification is not a concern. Availability impact is high, indicating potential disruption of service. However, exploitation requires local access and user interaction.

Microsoft has released an official fix for CVE-2026-32188. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps are updated to the latest version as per Microsoft's guidance in the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188. No additional mitigation actions are required beyond applying the official fix.