This vulnerability (CVE-2026-48580) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise is classified as CWE-822: Untrusted Pointer Dereference. It allows an unauthorized attacker to locally disclose information by exploiting improper handling of pointers. The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, user interaction needed, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service.

An unauthorized local attacker can disclose sensitive information due to improper pointer dereference in Microsoft Excel. The confidentiality impact is high, but there is no impact on integrity or availability. Exploitation requires user interaction and no privileges, limiting the attack scope to local scenarios.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48580.