This vulnerability (CVE-2026-56156) is a heap-based buffer overflow in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector with low attack complexity, no privileges required, user interaction required, and complete impact on confidentiality, integrity, and availability. The vendor has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation allows local code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. Since this is a heap-based buffer overflow, it may allow execution of arbitrary code with the privileges of the user running Microsoft Excel.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the latest patched version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56156.