This vulnerability is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1) that could allow an unauthorized attacker to execute code locally. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, but user interaction is needed. The impact includes high confidentiality, integrity, and availability impact. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits in the wild have been reported at this time.

Successful exploitation of this heap-based buffer overflow could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected application with high impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50301 to apply the fix.