CVE-2026-108435: CWE-822: Untrusted Pointer Dereference in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108435) is an untrusted pointer dereference in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to disclose information remotely over a network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality without affecting integrity or availability. The vulnerability is officially fixed by Microsoft, and the vendor advisory confirms patch availability and remediation.

Successful exploitation can lead to unauthorized disclosure of information over a network. The vulnerability does not impact integrity or availability. It requires user interaction but no privileges, making it a moderate risk for information leakage.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108435 to mitigate this vulnerability.