This vulnerability (CVE-2026-55122) is an out-of-bounds read issue classified under CWE-125 in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to perform local information disclosure. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The confidentiality impact is high, with no impact on integrity and high impact on availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly stated is 16.0.1.

An attacker can exploit this vulnerability to read memory outside the intended bounds, leading to local disclosure of sensitive information. The impact is confidentiality loss and potential denial of service (availability impact). There is no integrity impact. The vulnerability requires local access and user interaction but no privileges, making it a significant risk for local users.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55122 to mitigate this vulnerability.