This vulnerability (CVE-2026-40419) is a use-after-free flaw (CWE-416) in Microsoft 365 Apps for Enterprise that enables an authorized local attacker to elevate privileges. The CVSS 3.1 vector indicates low attack complexity and privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this issue. The vulnerability affects version 16.0.1 of Microsoft 365 Apps for Enterprise. As this is a cloud service, Microsoft manages the remediation process server-side. No known exploits are currently reported in the wild.

Successful exploitation allows an authorized local attacker to elevate their privileges, potentially gaining higher access rights on the affected system. The vulnerability impacts confidentiality, integrity, and availability with high severity. There are no reports of active exploitation in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419. No additional mitigation actions are currently required.