This vulnerability (CVE-2026-55042) in Microsoft 365 Apps for Enterprise is classified as CWE-908 (Use of Uninitialized Resource). It allows an unauthorized attacker with local access to disclose information due to the use of uninitialized resources within Microsoft Office components. The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An unauthorized attacker with local access and user interaction can exploit this vulnerability to disclose sensitive information. The confidentiality impact is high, but integrity and availability are not affected. There are no known active exploits in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as provided in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55042 to mitigate this vulnerability.