This vulnerability, identified as CWE-822, involves an untrusted pointer dereference in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. Exploitation could enable an unauthorized attacker to execute code locally on the affected system. The CVSS v3.1 base score is 7.8, indicating high severity with local attack vector, low complexity, no privileges required, and user interaction needed. Microsoft has released an official fix for this issue and manages remediation for this cloud-hosted service. The affected version explicitly stated is 16.0.1.

Successful exploitation of this vulnerability could lead to local code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the provided patch for Microsoft 365 Apps for Enterprise version 16.0.1 as detailed in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55136. Since this is a cloud service, Microsoft manages remediation server-side, but local client updates should be applied promptly to mitigate risk.