This vulnerability, identified as CVE-2026-55137 and classified under CWE-122, involves a heap-based buffer overflow in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. Exploitation could enable an attacker to execute arbitrary code locally. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud service. The affected version explicitly includes version 16.0.1.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected application and system. The high CVSS score indicates significant impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55137. No additional mitigation steps are required beyond applying the official fix.