This vulnerability (CVE-2026-23657) involves a use-after-free condition in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. Exploitation could allow an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud service. The affected version explicitly stated is 16.0.1.

Successful exploitation can lead to local code execution by an unauthorized attacker, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.8. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657.