This vulnerability (CVE-2026-55129) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1) that could allow an unauthorized attacker to execute code locally. The CVSS v3.1 score is 7.8, indicating high severity, with impact on confidentiality, integrity, and availability. The vulnerability requires local access with user interaction and has a low attack complexity. Microsoft has published an official fix and manages remediation for the cloud service. No known exploits are reported in the wild at this time.

Successful exploitation of this heap-based buffer overflow can lead to local code execution with high impact on confidentiality, integrity, and availability of the affected system. The attacker does not require privileges but does require user interaction. This can compromise the affected Microsoft 365 Apps for Enterprise environment.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55129 to ensure their environment is updated and protected.