CVE-2026-78518: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-78518) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw allows remote code execution by an unauthorized attacker over a network. The CVSS 3.1 base score is 8.8 (high severity), with attack vector network, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected versions include multiple version ranges prior to fixed builds as specified.

Successful exploitation could allow an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system. No active exploitation in the wild has been reported.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78518. Since this is a cloud service, Microsoft manages remediation server-side, but local client updates may also be necessary.