This vulnerability (CVE-2025-21363) in Microsoft 365 Apps for Enterprise is classified as CWE-822: Untrusted Pointer Dereference. It allows an attacker to execute arbitrary code remotely via Microsoft Word by exploiting improper handling of pointers. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction needed. The vulnerability affects version 16.0.1 of Microsoft 365 Apps for Enterprise. Microsoft has published an advisory and provides a patch. Since this is a cloud service, Microsoft manages the remediation server-side.

Successful exploitation could allow an attacker to execute arbitrary code with high impact on confidentiality, integrity, and availability of the affected system. The attack requires local access and user interaction, limiting remote exploitation. No known exploits are reported in the wild at this time.

A patch is available for this vulnerability. Microsoft manages remediation for this cloud-hosted service; users should ensure their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21363. No additional mitigation actions are specified by the vendor.