This vulnerability (CVE-2025-21366) is classified as CWE-416 (Use After Free) in Microsoft 365 Apps for Enterprise, particularly Microsoft Access. It allows an attacker to execute remote code by exploiting improper memory handling. The CVSS v3.1 score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, but user interaction needed. The vulnerability affects version 16.0.1. Microsoft has released an official fix for this issue and manages remediation for this cloud-hosted service. No known exploits are reported in the wild as of the publication date.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code remotely with high impact on confidentiality, integrity, and availability. This could lead to full compromise of the affected Microsoft 365 Apps for Enterprise environment. However, exploitation requires user interaction and local access.

An official fix is available from Microsoft. Users and administrators should apply the provided update to Microsoft 365 Apps for Enterprise version 16.0.1 or later as indicated by the vendor advisory. Since this is a cloud service, Microsoft manages remediation on their side for cloud-hosted components. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21366 for detailed patching instructions.