CVE-2026-78502: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-78502) involves an out-of-bounds read in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw to disclose information remotely without privileges but requires user interaction. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has published an official fix for this issue, and affected versions are those prior to certain build numbers as specified in the affectedVersions field. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of information over a network. There is no impact on integrity or availability. The attacker does not require privileges but does require user interaction. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78502. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation steps are indicated by the vendor advisory.