This vulnerability (CVE-2025-21354) in Microsoft 365 Apps for Enterprise is classified as CWE-822: Untrusted Pointer Dereference. It allows remote code execution via Microsoft Excel due to improper handling of pointers. The CVSS 3.1 base score is 8.4, indicating high severity, with attack vector local, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects version 16.0.1. Microsoft has issued an official fix and manages remediation for this cloud service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21354.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability is exploitable locally without privileges or user interaction, posing a significant risk to affected systems. However, no known exploits are currently reported in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version or later as per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21354.