This vulnerability (CVE-2026-45458) involves a use-after-free condition in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to execute arbitrary code locally. The vulnerability affects version 16.0.1 of the software. The CVSS 3.1 base score is 8.4, indicating high severity, with attack vector local, low attack complexity, no privileges required, and no user interaction needed. Confidentiality, integrity, and availability impacts are all high. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code on the affected system with high impact on confidentiality, integrity, and availability. The attack requires local access but no privileges or user interaction. This could lead to full compromise of the affected Microsoft 365 Apps for Enterprise environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45458 to mitigate this vulnerability.