This vulnerability (CVE-2026-40358) involves a use-after-free condition in Microsoft 365 Apps for Enterprise, specifically version 16.0.1. It allows an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 base score is 8.4, indicating high severity, with attack vector local, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits have been reported in the wild.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. However, there are currently no known exploits in the wild. The vulnerability affects Microsoft 365 Apps for Enterprise version 16.0.1.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation on their side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358. No additional action is required beyond applying the official fix.