This vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It allows an unauthorized attacker to execute arbitrary code locally on the affected system. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector is local with low attack complexity, no privileges required, but user interaction is necessary. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are currently reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary code on the local system, potentially leading to full compromise of the affected application and system resources. The vulnerability impacts confidentiality, integrity, and availability of the system. However, exploitation requires local access and user interaction, which limits remote exploitation.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as per Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55125. No additional mitigation actions are required beyond applying the official fix.