This vulnerability involves an integer underflow (wrap or wraparound) in Microsoft Office within Microsoft 365 Apps for Enterprise. An attacker could exploit this flaw to execute code locally without authorization. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges, and user interaction, but results in high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service.

Successful exploitation could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires local access and user interaction to exploit.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64909 for detailed patching instructions and ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version.