This vulnerability (CVE-2026-64898) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1). It allows an unauthorized attacker to execute code locally on the affected system. The CVSS v3.1 score is 7.8, indicating high severity with impact on confidentiality, integrity, and availability. The vulnerability requires local attack vector with low attack complexity and no privileges required, but user interaction is needed. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits have been reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, exploitation requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64898.