This vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft 365 Apps for Enterprise (version 16.0.1). It allows an unauthorized attacker to execute code locally on the affected system. The CVSS v3.1 score is 8.4, indicating high severity with local attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects confidentiality, integrity, and availability with high impact. Microsoft has provided an official fix and manages remediation for this cloud service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the critical nature of the impact. However, there are currently no known active exploits in the wild.

An official fix is available from Microsoft. Users and administrators should apply the patch as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40363. Since this is a cloud-hosted service, Microsoft manages remediation on their side, but customers should ensure their environments are updated accordingly. No additional mitigation steps are indicated by the vendor.