This vulnerability (CWE-125) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS v3.1 score is 7.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

Successful exploitation can lead to local information disclosure, potentially exposing sensitive data. The vulnerability impacts confidentiality, integrity, and availability with high severity. However, exploitation requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40360.