CVE-2026-78522: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-78522 is a vulnerability classified as CWE-125 (Out-of-bounds Read) affecting Microsoft Office Word in Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed builds. Microsoft has released an official patch to address this issue.

Successful exploitation of this vulnerability could allow an attacker to disclose sensitive information remotely without requiring privileges. The impact is limited to confidentiality, with no integrity or availability impact reported. No active exploitation has been observed in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78522. Since this is a cloud service as well, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are specified by the vendor.