This vulnerability (CVE-2026-44819) involves a heap-based buffer overflow in Microsoft 365 Apps for Enterprise, enabling local code execution by an unauthorized attacker. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability with high severity. The product is a cloud service, and Microsoft has released an official fix to address this issue.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.8. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44819.