CVE-2026-55948 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. This vulnerability enables an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability affects version 16.0.1 of the product. Microsoft has published an official fix and manages remediation for the cloud service version. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of the impacted Microsoft 365 Apps for Enterprise environment. The vulnerability affects confidentiality, integrity, and availability with high impact.

An official fix is available from Microsoft. Users and administrators should apply the provided security update as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55948. For the cloud-hosted Microsoft 365 Apps for Enterprise service, Microsoft manages remediation server-side. No additional user action is required for the cloud service beyond applying updates if applicable.