This vulnerability (CVE-2026-50665) involves an out-of-bounds read in Microsoft 365 Apps for Enterprise (version 16.0.1). An unauthorized attacker can exploit this flaw locally to read memory outside the intended bounds, potentially disclosing sensitive information. The vulnerability has a CVSS v3.1 score of 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction needed. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No active exploitation has been reported.

Successful exploitation can lead to unauthorized disclosure of information on the affected system. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector. However, exploitation requires local access and user interaction, limiting remote exploitation potential. There are no known exploits in the wild currently.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50665 to mitigate this vulnerability.