This vulnerability (CVE-2026-45457) is an out-of-bounds read issue in Microsoft Office Word within Microsoft 365 Apps for Enterprise. The flaw arises from dereferencing an untrusted pointer, enabling an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. The affected version explicitly identified is 16.0.1.

Successful exploitation could lead to local code execution by an unauthorized attacker, potentially resulting in full confidentiality, integrity, and availability compromise of the affected system. The vulnerability is rated high severity with a CVSS score of 7.8. No known exploits are currently reported in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45457 to mitigate this vulnerability.