This vulnerability (CVE-2026-40362) is a use-after-free heap-based buffer overflow in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code locally on the affected system. The vulnerability is rated high severity with a CVSS 3.1 score of 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

Successful exploitation could lead to local code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects Microsoft 365 Apps for Enterprise Excel component version 16.0.1. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the update provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40362. Since this is a cloud-hosted service, Microsoft manages remediation server-side; verify that your environment is updated accordingly.