CVE-2026-54988 is a CWE-125 out-of-bounds read vulnerability in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to perform a local information disclosure by reading memory outside the intended bounds. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity, with attack vector local, low attack complexity, no privileges required, and requires user interaction. The vendor has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability allows an unauthorized local attacker to disclose information from memory outside the intended boundaries, potentially exposing sensitive data. There is no impact on integrity, but availability impact is rated high. No remote exploitation is indicated, and user interaction is required.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54988 to ensure their Microsoft 365 Apps for Enterprise environment is updated to the fixed version.