This vulnerability involves a heap-based buffer overflow in Microsoft Office Word as part of Microsoft 365 Apps for Enterprise. The flaw could allow an unauthorized attacker to disclose information locally on a vulnerable system. The CVSS 3.1 base score is 3.3, reflecting low impact with limited confidentiality loss and no integrity or availability impact. Exploitation requires local access and user interaction. Microsoft has released an official fix and manages remediation for this cloud service.

An attacker with local access and the ability to trick a user into interacting with a malicious document could disclose limited information due to the heap-based buffer overflow. There is no impact on integrity or availability. The overall impact is low.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45466.