CVE-2026-40359 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code locally by exploiting improper memory management. The vulnerability affects version 16.0.1. Microsoft has published an official fix and manages remediation for the cloud-hosted service. The CVSS v3.1 score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability. No known exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of the affected application and access to sensitive data. The CVSS score reflects high impact on confidentiality, integrity, and availability. However, no active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates as soon as possible. Since this is a cloud service, Microsoft manages remediation server-side; verify the vendor advisory for confirmation of patch deployment status. No additional mitigation actions are specified by the vendor.