This vulnerability involves a heap-based buffer overflow in Microsoft 365 Apps for Enterprise, specifically version 16.0.1, which could allow an unauthorized attacker to execute code locally on the affected system. It is categorized as CWE-822, indicating an untrusted pointer dereference issue. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation could lead to local code execution by an unauthorized attacker, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system. The high CVSS score indicates significant risk if exploited.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45645 for detailed patching and update instructions to ensure the vulnerability is addressed.