This vulnerability (CVE-2026-20952) involves a use-after-free condition in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to execute arbitrary code locally. The CVSS 3.1 base score is 8.4, indicating high impact on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation could allow an attacker to execute code locally with high impact on confidentiality, integrity, and availability of the affected system. This could lead to full compromise of the local environment where the vulnerable Microsoft 365 Apps for Enterprise version is installed.

An official fix is available from Microsoft. Users should apply the update for Microsoft 365 Apps for Enterprise version 16.0.1 or later as provided in the Microsoft security update guide. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20952 for detailed patching instructions.