This vulnerability, identified as CWE-416 (Use After Free), exists in Microsoft Office Word as part of Microsoft 365 Apps for Enterprise version 16.0.1. It enables an attacker without privileges to execute code locally by exploiting a use-after-free condition. The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

An official fix is available from Microsoft and should be applied promptly. Since this is a cloud-hosted service, Microsoft manages the remediation process. Users and administrators should follow guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657 to ensure their environments are updated. No additional mitigation actions are indicated by the vendor.