This vulnerability (CVE-2026-45471) is classified as CWE-822: Untrusted Pointer Dereference in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code locally by exploiting improper handling of pointers. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected version explicitly identified is 16.0.1.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Microsoft 365 Apps for Enterprise installation. However, exploitation requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45471 to mitigate this vulnerability.