This vulnerability (CWE-125) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS 3.1 base score is 3.3, reflecting low impact with local attack vector, low complexity, no privileges required, and user interaction needed. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An attacker can gain unauthorized local information disclosure due to the out-of-bounds read. There is no impact on integrity or availability. The attack requires local access and user interaction, limiting the scope and severity of the impact.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45455 to mitigate this vulnerability.