This vulnerability, identified as CVE-2026-23657 and categorized under CWE-416 (Use After Free), exists in Microsoft Office Word as part of Microsoft 365 Apps for Enterprise version 16.0.1. It allows an attacker without privileges to execute code locally by exploiting a use-after-free condition. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has issued an official patch to remediate this vulnerability and manages remediation for this cloud-hosted service. No public exploitation has been reported.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of the impacted application. The vulnerability impacts confidentiality, integrity, and availability (all rated high). However, exploitation requires local access and user interaction.

An official fix is available from Microsoft. Users and administrators should apply the provided patch promptly to remediate this vulnerability. Since this is a cloud service, Microsoft manages remediation for the hosted environment; customers should verify that their Microsoft 365 Apps for Enterprise installations are updated to the fixed version. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657 for detailed update instructions.