This vulnerability, identified as CVE-2026-63529 and classified under CWE-125 (Out-of-bounds Read), affects Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to perform an out-of-bounds read, potentially disclosing sensitive information locally. The CVSS 3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker with local access and requiring user interaction can exploit this vulnerability to disclose sensitive information from memory. There is no impact on integrity or availability. The confidentiality impact is high, but the attack complexity and vector limit the exploitability to local scenarios.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation. Users should apply the official update as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63529 to mitigate this vulnerability.