This vulnerability (CWE-416) involves a use-after-free condition in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. Exploitation allows local code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. The CVSS v3.1 vector indicates low attack complexity, no privileges required, user interaction needed, and scope unchanged. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation can lead to local code execution with full impact on confidentiality, integrity, and availability. This means an attacker could run arbitrary code on the affected system, potentially leading to system compromise or data loss.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54131 to mitigate this vulnerability.