CVE-2026-54131 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. This vulnerability allows an attacker without privileges to execute code locally by exploiting improper memory handling. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and full confidentiality, integrity, and availability impact. The vulnerability affects version 16.0.1. Microsoft has published an official fix and manages remediation for the cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected application and system. The vulnerability requires local access and user interaction but no privileges, making it a significant risk if exploited.

An official fix is available from Microsoft. Since this vulnerability affects the cloud-hosted Microsoft 365 Apps for Enterprise service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per Microsoft's guidance in the advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54131.