This vulnerability is a use-after-free (CWE-416) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally by exploiting the use-after-free condition. The CVSS 3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1 of the product. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects significant potential impact if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70311 to ensure their environments are updated and protected.