This vulnerability (CVE-2026-55041) involves a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw permits unauthorized local code execution, potentially compromising confidentiality, integrity, and availability. The CVSS 3.1 vector indicates low attack complexity, no privileges required, but user interaction is needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation could allow an attacker to execute arbitrary code locally, leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects Microsoft 365 Apps for Enterprise Excel component, potentially impacting users who open maliciously crafted Excel files.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55041.