This vulnerability is a stack-based buffer overflow in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It enables an unauthorized attacker to execute arbitrary code locally by exploiting the overflow condition. The vulnerability has a CVSS v3.1 base score of 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, but user interaction needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation allows an attacker to execute arbitrary code locally with high impact on confidentiality, integrity, and availability. This could lead to full compromise of the affected system. However, exploitation requires local access and user interaction.

An official fix is available from Microsoft and should be applied promptly. Since this is a cloud service, Microsoft manages remediation server-side; users should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55899 for detailed patching instructions.