CVE-2026-78503: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-78503 is a vulnerability classified as CWE-125 (out-of-bounds read) affecting Microsoft Office Word in Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The vulnerability is remotely exploitable without privileges but requires user interaction. Microsoft has published an official fix addressing this issue. The affected versions span several build ranges prior to fixed versions as specified by Microsoft.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of information over a network. The vulnerability does not impact integrity or availability but compromises confidentiality. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the provided security updates as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78503. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are required beyond applying the official patches.