This vulnerability (CVE-2026-45472) involves a use-after-free condition in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to execute arbitrary code locally. The CVSS 3.1 vector indicates low attack complexity and no user interaction required, with high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly stated is 16.0.1.

Successful exploitation could lead to local code execution by an unauthorized attacker, resulting in full compromise of confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild currently.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45472.