This vulnerability, tracked as CVE-2026-45645 and classified under CWE-822 (Untrusted Pointer Dereference), affects Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to execute code locally by exploiting improper handling of pointers in Microsoft Office. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, and user interaction required. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of the affected Microsoft 365 Apps for Enterprise environment. The impact includes high confidentiality, integrity, and availability consequences.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45645 to ensure protection.