This vulnerability (CWE-416) involves a use-after-free condition in Microsoft 365 Apps for Enterprise (version 16.0.1). An attacker with local access and the ability to trick a user into interacting with a malicious file could execute arbitrary code on the affected system. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are currently reported in the wild.

Successful exploitation allows an attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The attack requires local access and user interaction but can result in significant impact on the targeted environment.

An official fix is available from Microsoft. Users and administrators should apply the provided update for Microsoft 365 Apps for Enterprise version 16.0.1 as detailed in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65657). Since this is a cloud service, Microsoft manages remediation server-side, but clients should ensure their applications are updated accordingly.