This vulnerability (CVE-2025-21356) is a type confusion issue (CWE-843) in Microsoft Office Visio within Microsoft 365 Apps for Enterprise. It allows an attacker to execute remote code by exploiting improper access of resources using incompatible types. The CVSS 3.1 score is 7.8 (high), indicating a significant impact on confidentiality, integrity, and availability. The attack requires local access, low complexity, no privileges, but user interaction. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation could allow an attacker to execute arbitrary code remotely, leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects Microsoft Office Visio in Microsoft 365 Apps for Enterprise version 16.0.1. The attack requires local access and user interaction but no privileges, making it a significant risk if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated to the latest patched version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21356.