CVE-2026-55137 is a heap-based buffer overflow vulnerability in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. This vulnerability allows an unauthorized attacker to execute code locally. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1. Microsoft has issued an official fix, and as this is a cloud service, remediation is managed by the vendor. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation of this heap-based buffer overflow could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected application and data. The vulnerability requires local access and user interaction to exploit.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their installations are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55137 to mitigate this vulnerability.