This vulnerability is a stack-based buffer overflow (CWE-121) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It enables an unauthorized attacker to execute arbitrary code locally. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55055.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the impacted application. However, exploitation requires local access and user interaction. No active exploitation in the wild has been reported.

An official fix is available from Microsoft. Users of Microsoft 365 Apps for Enterprise version 16.0.1 should apply the patch as provided by Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55055 for detailed patching instructions.