This vulnerability (CVE-2026-45475) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1). It allows an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges, and user interaction. The impact includes high confidentiality, integrity, and availability impacts. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction but does not require privileges.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45475 to ensure protection.