CVE-2026-78520: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-78520 is a CWE-125 out-of-bounds read vulnerability in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. The vulnerability enables an unauthorized attacker to execute code remotely over a network. It affects multiple version ranges of Microsoft 365 Apps for Enterprise prior to fixed builds. The CVSS 3.1 base score is 6.5, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and high confidentiality impact but no integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

Successful exploitation allows an unauthorized attacker to execute code remotely on the affected system, potentially compromising confidentiality. The vulnerability does not impact integrity or availability. The medium CVSS score reflects the moderate risk posed by this flaw.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78520 to remediate this vulnerability.