CVE-2026-108444: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-108444 is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft 365 Apps for Enterprise. It allows an attacker to execute remote code by exploiting the flaw when a user interacts with a specially crafted file or content. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to the patched versions. The CVSS 3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has published an official security update to address this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of the affected Microsoft 365 Apps for Enterprise environment. The vulnerability impacts confidentiality, integrity, and availability of the system. No known exploits are reported in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the security updates provided by Microsoft as soon as possible. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108444 for detailed patch information and deployment instructions.