This vulnerability (CVE-2026-32199) is a use-after-free issue (CWE-416) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to execute arbitrary code locally by exploiting the use-after-free condition. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity but requiring user interaction. Microsoft has acknowledged the issue and provided an official fix. The product is a cloud service, and Microsoft manages remediation for this service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the local user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, exploitation requires user interaction and local access. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Users and administrators should apply the provided security update as soon as possible to remediate this vulnerability. Since this is a cloud service, Microsoft manages the remediation on their side; customers should verify that their Microsoft 365 Apps for Enterprise installations are updated to the fixed version. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199 for detailed patch information and guidance.