CVE-2026-69719: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CWE-126 (Buffer Over-read), affects Microsoft Office Word in Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to cause a buffer over-read, potentially leading to information disclosure over a network. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service. The affected versions include multiple version ranges prior to specific build numbers as detailed in the affectedVersions field.

An attacker can exploit this vulnerability to disclose sensitive information over a network without requiring privileges but with user interaction. The impact is limited to confidentiality with no integrity or availability effects. There are no known active exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69719 to mitigate this vulnerability.