CVE-2026-69626: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CWE-126 (Buffer Over-read), exists in Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to cause a buffer over-read, potentially leading to information disclosure over a network. The CVSS 3.1 base score is 6.5, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has issued an official fix for affected versions, and the vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69626. The vulnerability affects multiple version ranges of Microsoft 365 Apps for Enterprise prior to the fixed versions.

An attacker can exploit this vulnerability to disclose sensitive information over a network without requiring privileges but with user interaction. There is no impact on integrity or availability. No known exploits are currently active in the wild.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69626. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Applying the official patches will mitigate the vulnerability.