This vulnerability (CVE-2026-45475) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It enables an unauthorized attacker to execute arbitrary code locally, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, indicating high severity. The attack vector is local with low attack complexity and no privileges required, but user interaction is necessary. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation allows an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected application, including unauthorized access to sensitive information, modification of data, and disruption of service.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45475 for detailed patching and update instructions to ensure the vulnerability is addressed.