This vulnerability (CWE-125) involves an out-of-bounds read in Microsoft 365 Apps for Enterprise, which could allow an unauthorized local attacker to disclose information. The CVSS vector indicates the attack requires local access with low complexity and no privileges but requires user interaction. The impact is limited to availability (denial of service) with no confidentiality or integrity impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

The vulnerability allows an unauthorized attacker with local access and user interaction to cause an out-of-bounds read, potentially leading to information disclosure and impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their service is updated according to Microsoft's guidance found in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55121.