This vulnerability (CVE-2026-45643) is classified as CWE-822: Untrusted Pointer Dereference. It exists in Microsoft Office Word within Microsoft 365 Apps for Enterprise. The flaw allows an attacker to cause the application to dereference a pointer that is not trusted, potentially leading to local code execution. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vendor has released an official fix and manages remediation for this cloud-hosted service. The affected version explicitly identified is 16.0.1.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of the affected application and associated user privileges. The impact includes high confidentiality, integrity, and availability consequences as indicated by the CVSS vector.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45643 to mitigate this vulnerability.