This vulnerability (CVE-2026-45643) is an untrusted pointer dereference issue in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, requiring user interaction. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction needed. The vendor has released an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation allows an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability. The attack requires local access and user interaction. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45643.