This vulnerability (CVE-2026-32190) involves a use-after-free condition in Microsoft 365 Apps for Enterprise (version 16.0.1) that could allow an attacker to execute arbitrary code locally without user interaction or privileges. The CVSS 3.1 base score is 8.4, reflecting high impact on confidentiality, integrity, and availability. The vendor has issued an official fix and manages remediation for this cloud-hosted service. No active exploitation has been reported.

Successful exploitation could result in local code execution by an unauthorized attacker, potentially leading to full compromise of the affected Microsoft 365 Apps environment. The vulnerability impacts confidentiality, integrity, and availability at a high level. However, no known exploits are currently active in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32190 to protect against this vulnerability.