CVE-2026-78506: CWE-170: Improper Null Termination in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-78506) involves improper null termination in Microsoft Office Word within Microsoft 365 Apps for Enterprise. The flaw can be exploited by an unauthorized attacker with local access to disclose sensitive information. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has released an official fix for affected versions.

An unauthorized attacker with local access and requiring user interaction can exploit this vulnerability to disclose information. There is no impact on integrity or availability. No known active exploitation has been reported.

Microsoft has provided an official fix for this vulnerability. Users and administrators should apply the available patches as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78506. Since this is a cloud service, Microsoft manages remediation for cloud-hosted components. No additional mitigation is required beyond applying the official update.