This vulnerability (CVE-2026-55037) involves a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw could allow an attacker without privileges to execute code locally by exploiting this overflow condition. The vulnerability has been assigned a CVSS v3.1 score of 7.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

Successful exploitation of this heap-based buffer overflow could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected application and system. The vulnerability impacts confidentiality, integrity, and availability with high severity. However, no exploits in the wild have been reported so far.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise installations are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55037. No additional mitigation actions are currently required beyond applying the official fix.