This vulnerability in Microsoft 365 Apps for Enterprise is caused by a use-after-free condition resulting from type confusion, which enables an unauthorized attacker to execute code locally. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, and no user interaction needed. Confidentiality, integrity, and availability impacts are all high. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected version explicitly stated is 16.0.1.

Successful exploitation allows an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This can result in unauthorized code execution without requiring user interaction or privileges.

An official fix is available from Microsoft. Because this is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45458. No additional mitigation actions are required beyond applying the official fix.