This vulnerability (CVE-2025-21395) is a heap-based buffer overflow in Microsoft Access, part of Microsoft 365 Apps for Enterprise version 16.0.1. It enables remote code execution if successfully exploited. The CVSS v3.1 score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, but user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high impact. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation could allow an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The attack requires local access and user interaction but no privileges, making it a significant risk if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21395 to mitigate this vulnerability.