CVE-2026-108436: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108436) is an out-of-bounds read (CWE-125) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to remotely disclose information by reading memory outside the intended bounds. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation can lead to unauthorized disclosure of information over a network. There is no impact on integrity or availability. The vulnerability requires user interaction but no privileges or authentication. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108436 to mitigate this vulnerability.