This vulnerability (CVE-2026-45485) involves an out-of-bounds read in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to disclose information locally. The CVSS 3.1 base score is 3.3, reflecting low impact with local attack vector, low complexity, no privileges required, and user interaction needed. The vulnerability affects version 16.0.1. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. No known exploitation in the wild has been reported.

An attacker who can execute code locally and induce user interaction may read memory outside the intended bounds, potentially disclosing sensitive information. There is no impact on integrity or availability. The overall impact is limited to confidentiality with low severity.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Administrators and users should ensure their Microsoft 365 Apps are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45485.