This vulnerability is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It enables an unauthorized attacker to execute code locally, impacting confidentiality, integrity, and availability with a CVSS 3.1 score of 7.8 (high severity). The attack vector is local with low attack complexity and no privileges required, but user interaction is necessary. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation can lead to local code execution by an unauthorized attacker, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This can allow execution of arbitrary code with the privileges of the user running the application.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55056 to mitigate this vulnerability.