This vulnerability involves an integer overflow or wraparound issue in Microsoft 365 Apps for Enterprise (version 16.0.1). It allows an unauthorized attacker with local access to disclose sensitive information. The CVSS 3.1 vector indicates low attack complexity, no privileges required, no user interaction, and high confidentiality impact without affecting integrity or availability. Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation can lead to unauthorized local disclosure of information, impacting confidentiality. There is no impact on integrity or availability. The attack requires local access but no privileges or user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55026 to mitigate this vulnerability.