This vulnerability (CVE-2026-40359) is a use-after-free issue classified under CWE-416 affecting Microsoft Office Excel in Microsoft 365 Apps for Enterprise version 16.0.1. It enables an unauthorized attacker to execute code locally by exploiting improper memory handling. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vendor has issued an official fix and manages remediation for this cloud-hosted service. No public exploits have been reported.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of the impacted application and associated user privileges. The vulnerability impacts confidentiality, integrity, and availability with high impact ratings. However, exploitation requires local access and user interaction.

An official fix is available from Microsoft and should be applied promptly. Since this is a cloud-hosted service, Microsoft manages the remediation on their side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the latest patched version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40359. No additional mitigation actions are indicated by the vendor.