This vulnerability is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1) that could allow an unauthorized attacker to execute arbitrary code locally. The CVSS 3.1 score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation of this vulnerability could lead to local code execution with high impact on confidentiality, integrity, and availability. This could allow an attacker to run arbitrary code on the affected system with the privileges of the user running the application.

An official fix is available from Microsoft. Users and administrators should apply the provided update to Microsoft 365 Apps for Enterprise version 16.0.1 as directed in the Microsoft advisory. Since this is a cloud service, Microsoft manages remediation for the hosted environment. Check the Microsoft advisory for the latest update status and guidance.