This vulnerability (CVE-2026-55038) is a stack-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally. The CVSS v3.1 score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, but user interaction needed. The vulnerability impacts version 16.0.1 of Microsoft 365 Apps for Enterprise. Microsoft has released an official fix and manages remediation for this cloud service. There are no known exploits in the wild at this time.

Successful exploitation could allow an attacker to execute arbitrary code with high impact on confidentiality, integrity, and availability on the affected system. However, exploitation requires local access and user interaction. No active exploitation has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55038 to mitigate this vulnerability.