CVE-2026-72974: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-72974 and classified under CWE-126 (Buffer Over-read), affects multiple versions of Microsoft 365 Apps for Enterprise, specifically Microsoft Office Excel. It allows an attacker without privileges to cause a buffer over-read condition that can lead to unauthorized information disclosure over a network. The vulnerability has been assigned a CVSS v3.1 base score of 6.5, indicating medium severity. Microsoft has issued an official fix for this vulnerability and manages remediation for the cloud service. No active exploitation has been reported.

An attacker can exploit this vulnerability to read sensitive information from memory, potentially disclosing confidential data over a network. The vulnerability does not allow for integrity or availability impacts, only confidentiality is affected. No known active exploitation has been reported.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided updates as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72974. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation actions are required beyond applying the official fix.