CVE-2026-78519: CWE-908: Use of Uninitialized Resource in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-78519) is classified under CWE-908 (Use of Uninitialized Resource) and affects Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. It allows remote code execution by an unauthorized attacker due to improper initialization of resources. The CVSS 3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Multiple version ranges are affected, and Microsoft has issued an official fix. The vendor advisory confirms patch availability and that remediation is managed by Microsoft for this cloud service.

An attacker can remotely execute arbitrary code on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires no privileges but does require user interaction. The impact is rated high due to the potential for complete system compromise.

An official fix is available from Microsoft. Users and administrators should apply the updates provided by Microsoft to the affected versions of Microsoft 365 Apps for Enterprise. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78519 for the latest update and patch information.