This vulnerability (CVE-2026-55133) involves a heap-based buffer overflow in Microsoft Office OneNote within Microsoft 365 Apps for Enterprise. It permits an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.8, reflecting high impact with low attack complexity and no privileges required, but user interaction is necessary. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation allows local code execution by an unauthorized attacker, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This can lead to full control over the affected Microsoft 365 Apps for Enterprise environment, specifically the OneNote component.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55133 to ensure their environments are updated and protected.