This vulnerability (CVE-2026-55129) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It enables an unauthorized attacker to execute code locally, impacting confidentiality, integrity, and availability. The attack vector requires local access with low complexity and no privileges, but user interaction is necessary. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation allows an attacker to execute arbitrary code locally, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction but no privileges, making it a significant local threat.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55129 to mitigate this vulnerability.