This vulnerability is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1) that permits local code execution without requiring user interaction or privileges. The CVSS 3.1 vector indicates low attack complexity and no privileges or user interaction needed, with high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40363 to ensure their environments are updated and protected.