This vulnerability (CVE-2026-48580) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise is caused by an untrusted pointer dereference. This flaw allows an unauthorized attacker with local access to disclose sensitive information. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no privileges, but user interaction is required. The confidentiality impact is high, while integrity and availability are not affected. Microsoft has issued an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An unauthorized local attacker can exploit this vulnerability to disclose sensitive information on the affected system. The confidentiality impact is high, but there is no impact on integrity or availability. The attack requires local access and user interaction, limiting remote exploitation possibilities.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48580 to ensure their environment is updated and protected.