This vulnerability (CVE-2026-55133) is a heap-based buffer overflow in Microsoft Office OneNote, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS v3.1 score is 7.8, reflecting high impact with local attack vector, low attack complexity, no privileges required, but user interaction needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected version explicitly identified is 16.0.1.

Successful exploitation allows an attacker to execute arbitrary code locally, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. The attack requires local access and user interaction but no privileges. This can lead to full control over the affected Microsoft 365 Apps for Enterprise installation.

An official fix is available from Microsoft. Users and administrators should apply the provided update to Microsoft 365 Apps for Enterprise version 16.0.1 or later as recommended in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55133). Since this is a cloud-hosted service, Microsoft manages remediation server-side, but local clients should be updated accordingly.