CVE-2026-64904 is a type confusion vulnerability (CWE-843) in Microsoft 365 Apps for Enterprise (version 16.0.1) that permits unauthorized local code execution by accessing a resource using an incompatible type. The vulnerability has a CVSS 3.1 base score of 7.8 (high severity) with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation of this vulnerability allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment. The vulnerability requires local access and user interaction to exploit.

An official fix is available from Microsoft. Users of Microsoft 365 Apps for Enterprise version 16.0.1 should apply the update provided by Microsoft as detailed in their advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64904). Since this is a cloud-hosted service, Microsoft manages remediation on their side, but customers should ensure their clients are updated accordingly.