This vulnerability (CVE-2026-26113) in Microsoft 365 Apps for Enterprise is classified as CWE-822: Untrusted Pointer Dereference. It enables an attacker with local access to execute arbitrary code due to improper handling of pointers within the application. The CVSS v3.1 base score is 8.4, indicating high severity with local attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally with high impact on confidentiality, integrity, and availability. This could lead to full compromise of the affected system's Microsoft 365 Apps for Enterprise environment. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113 for detailed patching instructions and ensure their Microsoft 365 Apps for Enterprise environment is updated to the fixed version.