This vulnerability (CVE-2026-20948) in Microsoft Office Word within Microsoft 365 Apps for Enterprise is due to an untrusted pointer dereference (CWE-822). It allows an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud service. The affected version explicitly stated is 16.0.1.

Successful exploitation could lead to local code execution by an unauthorized attacker, compromising confidentiality, integrity, and availability of the affected system. However, exploitation requires local access and user interaction. There are no known exploits in the wild currently.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20948.