This vulnerability (CVE-2026-32190) involves a use-after-free condition in Microsoft 365 Apps for Enterprise, which can be exploited by an unauthorized attacker to execute code on the local system. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, and no user interaction needed. The impact includes high confidentiality, integrity, and availability impacts. Microsoft has published an official fix and manages remediation for this cloud service.

Successful exploitation could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32190 for the latest update and ensure their Microsoft 365 Apps for Enterprise environment is updated accordingly.