This vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft 365 Apps for Enterprise, specifically version 16.0.1. It enables an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges, and user interaction. The impact includes high confidentiality, integrity, and availability consequences. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation allows local code execution by an unauthorized attacker, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.8. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63533 for the latest update and ensure their Microsoft 365 Apps for Enterprise environment is updated accordingly.