This vulnerability involves an integer overflow or wraparound in Microsoft 365 Apps for Enterprise, which could be exploited by an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-63532 and is associated with CWE-190 (Integer Overflow or Wraparound). Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation could lead to local code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. However, no known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63532.