This vulnerability involves a heap-based buffer overflow in Microsoft 365 Apps for Enterprise, enabling an unauthorized attacker to execute code on the affected system locally. The issue is tracked as CWE-122 and has been assigned CVE-2026-44824. The vulnerability affects version 16.0.1 of the product. Microsoft has published an official fix and manages remediation for this cloud service. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected application environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44824 for detailed patching and update instructions.