This vulnerability (CVE-2026-55120) is a heap-based buffer overflow in Microsoft Office PowerPoint component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability affects version 16.0.1. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation of this heap-based buffer overflow can result in local code execution by an unauthorized attacker, leading to complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 7.8 reflects high impact with network attack vector limited to local access, low attack complexity, no privileges required, but user interaction needed.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55120.