This vulnerability (CVE-2026-55898) involves an out-of-bounds read (CWE-125) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to read memory beyond intended boundaries, potentially disclosing sensitive information locally. The CVSS 3.1 vector indicates local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), limited confidentiality impact (C:L), no integrity impact (I:N), and high availability impact (A:H). Microsoft has published an official fix for this vulnerability and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

An attacker can cause an out-of-bounds read in Excel, leading to local disclosure of information. The confidentiality impact is limited, but the availability impact is high, indicating potential disruption. No integrity impact is noted. The vulnerability requires local access and user interaction to exploit.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898 to address this vulnerability.