This vulnerability (CVE-2026-50467) involves a use-after-free condition in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to execute arbitrary code locally. The issue affects version 16.0.1 of the product. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the local user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50467 to ensure their environments are updated and protected.