This vulnerability involves a buffer over-read in Microsoft 365 Apps for Enterprise, which can be exploited by an unauthorized local attacker to disclose sensitive information. The vulnerability is identified as CWE-126 and affects version 16.0.1. The CVSS 3.1 vector indicates that the attack requires local access, high attack complexity, no privileges required, and user interaction is needed. The confidentiality impact is high, while integrity and availability are not affected. Microsoft has published an official fix and manages remediation for this cloud service.

An unauthorized local attacker can exploit this buffer over-read vulnerability to disclose sensitive information on the affected system. There is no impact on integrity or availability. The vulnerability requires local access and user interaction, and the attack complexity is high.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45460 to mitigate this vulnerability.