This vulnerability (CVE-2026-20953) is a use-after-free flaw in Microsoft 365 Apps for Enterprise, specifically version 16.0.1, which could allow an attacker to execute arbitrary code locally without user interaction or privileges. The issue arises from improper memory management leading to use-after-free conditions. Microsoft has acknowledged the vulnerability and provided an official fix. The product is a cloud service, and Microsoft manages remediation for this service. The CVSS 3.1 vector indicates low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. No known active exploitation has been reported.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20953 for detailed patching and update instructions. Applying the official update will mitigate this vulnerability.