This vulnerability, identified as CVE-2026-32198, is a use-after-free issue (CWE-416) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to execute code locally by exploiting improper memory handling. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, but user interaction needed. Confidentiality, integrity, and availability impacts are all high. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the impacted application. However, exploitation requires local access and user interaction. There are no known active exploits in the wild.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages remediation server-side. Users should ensure their Microsoft 365 Apps are updated to the latest version as per the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32198. No additional user action is required beyond applying the official update.