This vulnerability (CVE-2026-50408) involves an out-of-bounds read in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

An attacker with local access and requiring user interaction can exploit this vulnerability to disclose sensitive information from memory. There is no impact on integrity or availability. The confidentiality impact is high, meaning sensitive data could be exposed. However, exploitation requires local access and user interaction, limiting the attack surface.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50408. No additional mitigation actions are specified by the vendor.