This vulnerability (CVE-2026-45643) is classified as CWE-822: Untrusted Pointer Dereference in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code locally by exploiting improper handling of pointers. The CVSS 3.1 score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation could lead to local code execution by an unauthorized attacker, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to run arbitrary code with the privileges of the user running Microsoft Word.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45643 for update status and ensure their Microsoft 365 Apps for Enterprise environment is updated to the fixed version or later.