This vulnerability, tracked as CVE-2026-45471 and categorized under CWE-822 (Untrusted Pointer Dereference), exists in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an attacker to execute code locally by exploiting improper handling of pointers. The CVSS 3.1 score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has released an official fix for this cloud service, and remediation is managed by the vendor.

Successful exploitation could lead to local code execution by an unauthorized attacker, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction but does not require privileges, making it a significant risk if exploited.

An official fix is available from Microsoft and should be applied promptly. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45471 to ensure their environments are updated.