This vulnerability, identified as CVE-2026-55036 and classified under CWE-126 (Buffer Over-read), affects Microsoft Office Excel in Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to execute code locally by causing a buffer over-read condition. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Microsoft 365 Apps for Enterprise installation. The vulnerability requires local access and user interaction to be exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55036 to mitigate this vulnerability.