This vulnerability (CVE-2026-58651) involves a heap-based buffer overflow in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score is 7.8, reflecting high impact with local attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation allows unauthorized local code execution with high impact on confidentiality, integrity, and availability of the affected system. This could lead to full compromise of the affected Microsoft 365 Apps for Enterprise environment running the vulnerable version.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58651.