This vulnerability (CVE-2026-55125) involves a heap-based buffer overflow in Microsoft 365 Apps for Enterprise, enabling local code execution by an unauthorized attacker. The CVSS 3.1 vector indicates low attack complexity, no privileges required, but user interaction is needed. Confidentiality, integrity, and availability impacts are all high. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects Microsoft 365 Apps for Enterprise, which is cloud-hosted, so the impact is primarily on local client environments running the vulnerable version.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55125 to ensure protection.