CVE-2026-69778: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-69778) involves a heap-based buffer overflow in Microsoft Office Access, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code remotely over a network. The CVSS 3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. The affected versions include multiple version ranges below fixed builds such as <16.0.20326.20138, <16.0.5569.1002, <16.0.5569.1000, <16.0.10417.20207, <16.0.14334.20906, and <16.0.17932.20976. Microsoft has released official fixes and manages remediation for this cloud service. No known exploits in the wild have been reported at this time.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of affected systems. The vulnerability affects confidentiality, integrity, and availability of the impacted Microsoft 365 Apps for Enterprise installations.

An official fix is available from Microsoft. Users should apply the provided updates to affected versions as detailed in the Microsoft advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69778). Since this is a cloud-hosted service, Microsoft manages remediation server-side. Administrators should verify that their environments are updated to non-vulnerable versions.