This vulnerability is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1) that could allow an unauthorized attacker to execute code locally. The CVSS 3.1 vector indicates low attack complexity, no privileges required, but user interaction is needed. The impact includes high confidentiality, integrity, and availability impacts. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44819.

Successful exploitation could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, exploitation requires user interaction and local access. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Users and administrators should apply the provided update from the Microsoft update guide to remediate this vulnerability. Since this is a cloud-hosted service, Microsoft manages remediation on their side. Check the vendor advisory for the latest update and deployment guidance.