This vulnerability, identified as CVE-2026-50467 and classified under CWE-416 (Use After Free), exists in Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to execute code locally due to improper handling of memory after it has been freed. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability all rated high. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment. However, no known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50467 to ensure their environment is updated and protected.