This vulnerability is a stack-based buffer overflow (CWE-121) in Microsoft 365 Apps for Enterprise, specifically affecting version 16.0.1. It enables an unauthorized attacker to execute code locally on the affected system. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability with high impact.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63526 to mitigate this vulnerability.