This vulnerability (CVE-2026-55049) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1). It enables an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.8.

An official fix is available from Microsoft. Users should apply the update provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55049. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should verify that their Microsoft 365 Apps for Enterprise are updated to the fixed version.