This vulnerability, identified as CVE-2026-45461 and categorized under CWE-416 (Use After Free), affects Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code locally by exploiting a use-after-free condition in Microsoft Office. The CVSS 3.1 base score is 8.4, indicating high impact on confidentiality, integrity, and availability. The vulnerability requires low attack complexity, no privileges, and no user interaction. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation of this vulnerability could lead to local code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical nature of the impact if exploited.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure that their environments are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45461.