This vulnerability (CVE-2026-55124) in Microsoft 365 Apps for Enterprise arises from improper validation of input types in Microsoft Office Word. This flaw allows an unauthorized attacker with local access and user interaction to disclose sensitive information. The CVSS 3.1 base score is 5.5 (medium severity), with attack vector local, low complexity, no privileges required, and user interaction required. The vulnerability affects version 16.0.1. Microsoft has issued an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An unauthorized attacker with local access and user interaction can exploit this vulnerability to disclose confidential information. The impact is limited to confidentiality; integrity and availability are not affected. The attack complexity is low, and no privileges are required, but user interaction is necessary.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124 to ensure their environment is updated and protected.