This vulnerability (CVE-2026-55047) involves an out-of-bounds read in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to locally disclose sensitive information. The issue is classified under CWE-125. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. Microsoft has published an official fix for this vulnerability and manages remediation for this cloud-hosted service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could lead to unauthorized local disclosure of information, impacting confidentiality. There is no impact on integrity or availability. The attack requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55047 for applying the fix and ensure their Microsoft 365 Apps for Enterprise are updated to the patched version.