This vulnerability is a heap-based buffer overflow caused by a use-after-free condition in Microsoft 365 Apps for Enterprise (version 16.0.1). It enables an unauthorized local attacker to execute arbitrary code with high impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.4, indicating high severity. Microsoft has published an official fix and manages remediation for this cloud service. The vendor advisory is available at the Microsoft Security Response Center update guide.

Successful exploitation allows an unauthorized local attacker to execute arbitrary code, potentially leading to full compromise of the affected Microsoft 365 Apps for Enterprise environment. The vulnerability impacts confidentiality, integrity, and availability with high severity. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should ensure their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45474.