CVE-2026-40418 is a use-after-free vulnerability (CWE-416) in Microsoft 365 Apps for Enterprise that enables an authorized local attacker to elevate privileges. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity, with impact on confidentiality, integrity, and availability (all high). The attack vector requires local access with low complexity and privileges, and no user interaction is needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected version explicitly identified is 16.0.1.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher-level access within the affected Microsoft 365 Apps for Enterprise environment. The vulnerability impacts confidentiality, integrity, and availability at a high level. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418 to mitigate this vulnerability.