CVE-2026-69739: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability involves an out-of-bounds read in Microsoft 365 Apps for Enterprise, which can be exploited by an unauthorized attacker to disclose sensitive information over a network. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges and requires user interaction. The impact is limited to confidentiality loss without affecting integrity or availability. Microsoft has published an official fix for the affected versions and manages remediation for this cloud-hosted service.

An attacker can remotely cause an out-of-bounds read that leads to information disclosure. The vulnerability does not impact integrity or availability. No known active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the updates provided by Microsoft to the affected versions of Microsoft 365 Apps for Enterprise. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69739 for detailed update instructions.