This vulnerability (CVE-2026-45458) involves a use-after-free condition in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to execute arbitrary code locally. The vulnerability is classified under CWE-416. The CVSS v3.1 base score is 8.4, indicating high severity, with attack vector local, low attack complexity, no privileges required, and no user interaction needed. The vendor has released an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation could lead to local code execution with high impact on confidentiality, integrity, and availability of the affected system. Since the attack vector is local, an attacker must have local access to the system to exploit this vulnerability.

An official fix is available from Microsoft. Because this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45458 to mitigate this vulnerability.