This vulnerability, identified as CVE-2026-70314 and classified under CWE-20 (Improper Input Validation), affects Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to disclose information locally due to insufficient validation of input within Microsoft Office components. The CVSS v3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

The vulnerability enables unauthorized local information disclosure, which could lead to exposure of sensitive data on affected systems. There is no impact on integrity or availability. The attack requires local access and user interaction, limiting the scope of exploitation.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version as per Microsoft's guidance in the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70314.