This vulnerability, tracked as CVE-2025-21357 and classified under CWE-908 (Use of Uninitialized Resource), affects Microsoft Outlook within Microsoft 365 Apps for Enterprise version 16.0.1. It allows for remote code execution due to improper handling of uninitialized resources. The CVSS v3.1 base score is 6.7, indicating medium severity, with attack vector local, high attack complexity, low privileges required, and user interaction needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known active exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary code remotely with high impact on confidentiality, integrity, and availability. However, exploitation requires local access, high attack complexity, low privileges, and user interaction, limiting the ease of exploitation. No active exploits are known.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21357.