CVE-2026-45460 is a buffer over-read vulnerability (CWE-126) in Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to cause local information disclosure by reading beyond the intended buffer boundaries. The vulnerability has a CVSS 3.1 base score of 4.7, indicating medium severity, with attack vector local, high attack complexity, no privileges required, and user interaction required. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

An attacker with local access and user interaction can exploit this vulnerability to disclose sensitive information from memory due to a buffer over-read condition. There is no impact on integrity or availability. The confidentiality impact is high, but exploitation complexity and required conditions reduce the overall severity to medium.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45460 to mitigate this vulnerability.