This vulnerability (CVE-2026-40419) involves a use-after-free condition in Microsoft 365 Apps for Enterprise (version 16.0.1). It enables an authorized local attacker to elevate privileges by exploiting improper memory management. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability has been officially fixed by Microsoft, and the vendor manages remediation for this cloud-hosted service. No known active exploitation has been reported.

Successful exploitation allows an authorized local attacker to elevate their privileges, potentially gaining higher access rights than intended. This can lead to full compromise of the affected application and potentially the underlying system or environment. The impact is rated high due to the elevated privileges and potential for significant system control.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419 to apply the official fix.