This vulnerability (CVE-2026-55024) is a type confusion issue (CWE-843) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code locally by accessing resources using incompatible types. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector is local with low complexity and no privileges required, but user interaction is necessary. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are currently reported in the wild.

Successful exploitation can lead to local code execution by an unauthorized attacker, potentially resulting in full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires local access and user interaction, limiting remote exploitation scenarios.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55024 to mitigate this vulnerability.