This vulnerability (CVE-2026-44824) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1). It enables an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44824.

Successful exploitation allows local unauthorized attackers to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability affects Microsoft 365 Apps for Enterprise version 16.0.1. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44824 to apply the patch.