This vulnerability, tracked as CVE-2026-40358 and classified under CWE-416 (Use After Free), involves a heap-based buffer overflow in Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally on affected systems. The CVSS 3.1 base score is 8.4, indicating high severity with high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

Successful exploitation allows an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is rated high severity with CVSS 3.1 score 8.4. No known active exploitation has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should follow the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358 to ensure their environment is updated and protected.