CVE-2026-108434: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108434) involves an out-of-bounds read in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker can exploit this vulnerability to disclose sensitive information remotely without requiring privileges but with user interaction. The impact is limited to confidentiality; integrity and availability are not affected. No known active exploitation has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108434 to mitigate this vulnerability.