CVE-2026-32197 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise, version 16.0.1. The flaw could allow an unauthorized attacker to execute arbitrary code locally if a user interacts with a specially crafted file. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability. Microsoft has issued an official patch and manages remediation for this cloud-hosted service. No active exploitation has been observed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the local user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The attack requires user interaction but no prior privileges. The vulnerability affects Microsoft 365 Apps for Enterprise Excel version 16.0.1 and is present in cloud service deployments.

An official fix is available from Microsoft for this vulnerability. Microsoft manages remediation for the cloud-hosted Microsoft 365 Apps for Enterprise service. Users and administrators should apply the official patch as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32197. No additional mitigation steps are indicated by the vendor.