This vulnerability, identified as CVE-2026-40419, is a use-after-free issue (CWE-416) in Microsoft 365 Apps for Enterprise. It allows an authorized local attacker to elevate privileges on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability with high impact. Microsoft has released an official fix and manages remediation for this cloud service. The affected version explicitly stated is 16.0.1.

Successful exploitation of this use-after-free vulnerability can lead to local privilege escalation, granting the attacker higher privileges on the system. This can result in full compromise of confidentiality, integrity, and availability of the affected environment. No active exploitation in the wild has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419 to ensure their environment is updated and protected against this vulnerability.