This vulnerability (CVE-2026-55049) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1). It allows an unauthorized attacker to execute code locally on the affected system. The vulnerability has a CVSS 3.1 score of 7.8, indicating high severity with high impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation of this heap-based buffer overflow could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires local attack vector with low complexity and no privileges required but user interaction is needed.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55049.