This vulnerability (CWE-122) involves a heap-based buffer overflow in Microsoft 365 Apps for Enterprise (version 16.0.1). It enables an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability has been assigned a CVSS 3.1 base score of 7.5, indicating high severity, with attack vector network, high attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix and manages remediation for this cloud service.

Successful exploitation could allow remote code execution with high impact on confidentiality, integrity, and availability. This could enable an attacker to run arbitrary code in the context of the affected application, potentially leading to full system compromise.

An official fix is available from Microsoft. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77898 to ensure their environments are updated and protected.