CVE-2026-77911: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-77911) involves an out-of-bounds read in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose sensitive information remotely without requiring privileges but with user interaction. The issue affects specific versions including 16.0.0, 16.0.1, 19.0.0, and versions from 16.0.1 up to but not including 16.0.5569.1002. Microsoft has published an official fix to address this vulnerability.

An attacker can exploit this vulnerability to read memory beyond the intended boundaries, potentially disclosing sensitive information over a network. The vulnerability does not allow for integrity or availability impact but compromises confidentiality. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the provided patches as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77911. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are required beyond applying the official fix.