This vulnerability is a use-after-free condition (CWE-416) in Microsoft Office Click-To-Run component of Microsoft 365 Apps for Enterprise version 16.0.1. It permits an authorized local attacker to elevate their privileges on the affected system. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is addressed by an official fix provided by Microsoft. As this is a cloud service, Microsoft manages the patching process server-side. No public exploits have been reported.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher-level access than intended. This can lead to full compromise of the affected environment's confidentiality, integrity, and availability. No known active exploitation has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Administrators should verify that their Microsoft 365 Apps for Enterprise environment is updated to the latest patched version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418. No additional mitigation actions are required beyond applying the official fix.