This vulnerability, identified as CWE-126, involves a buffer over-read in Microsoft Office Word component of Microsoft 365 Apps for Enterprise version 16.0.1. The flaw allows an unauthorized attacker to execute code locally, requiring user interaction. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation could lead to local code execution by an unauthorized attacker, impacting confidentiality, integrity, and availability of the affected system. User interaction is required for exploitation. No known active exploits have been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64905 to ensure their environments are updated accordingly.