This vulnerability (CVE-2026-55947) is a heap-based buffer overflow in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally if a user interacts with a crafted file. The CVSS 3.1 score is 7.8 (High), reflecting local attack vector, low attack complexity, no privileges required, but user interaction needed. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild as of the publication date.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the local user, potentially leading to full compromise of the affected system. Confidentiality, integrity, and availability impacts are all rated high. However, exploitation requires local access and user interaction.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Administrators and users should ensure their software is updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55947.