This vulnerability (CVE-2026-54988) involves an out-of-bounds read (CWE-125) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to perform local information disclosure. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and limited confidentiality impact but high availability impact. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker can cause information disclosure locally by exploiting the out-of-bounds read flaw in Excel. The impact is limited to confidentiality loss of information on the local system. There is no indication of integrity compromise. The availability impact is rated high, suggesting potential disruption to service or application availability.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54988 to mitigate this vulnerability.