CVE-2026-108443: CWE-193: Off-by-one Error in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability is an off-by-one error (CWE-193) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Multiple affected version ranges are identified, and Microsoft has released an official fix. The vendor advisory confirms patch availability and cloud service remediation.

Successful exploitation allows an attacker to execute arbitrary code remotely on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the targeted system. No known active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as provided in the Microsoft Security Response Center advisory. Since this is a cloud-hosted service, Microsoft manages remediation server-side for cloud instances. Check the vendor advisory for the latest patch status and deployment guidance.