This vulnerability (CVE-2026-63527) is a stack-based buffer overflow in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally if a user interacts with a crafted file. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability requires low attack complexity but user interaction. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly stated is 16.0.1.

Successful exploitation allows local code execution with high impact on confidentiality, integrity, and availability of the affected system. This could lead to full compromise of the local environment where Microsoft 365 Apps for Enterprise is installed. However, exploitation requires user interaction and local access.

An official fix is available from Microsoft. Users of Microsoft 365 Apps for Enterprise version 16.0.1 should apply the update provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63527. Since this is a cloud service, Microsoft manages remediation server-side, but customers should verify their client versions are updated accordingly.