This vulnerability (CVE-2026-70317) in Microsoft 365 Apps for Enterprise arises from the use of an uninitialized resource, which can lead to local information disclosure by an unauthorized attacker. The CVSS 3.1 base score is 5.5 (medium severity), with attack vector local, low attack complexity, no privileges required, and user interaction required. The confidentiality impact is high, while integrity and availability are unaffected. Microsoft has released an official fix for this issue and manages remediation for this cloud-hosted service. No active exploitation has been reported.

An unauthorized local attacker can exploit this vulnerability to disclose sensitive information due to the use of an uninitialized resource. There is no impact on integrity or availability. The confidentiality impact is rated high, meaning sensitive data could be exposed locally.

Microsoft has provided an official fix for this vulnerability. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their environment is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70317. No additional user action is required beyond applying the official fix.