CVE-2026-78524: CWE-787: Out-of-bounds Write in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-78524 is an out-of-bounds write vulnerability (CWE-787) in Microsoft 365 Apps for Enterprise that enables remote code execution by an unauthorized attacker over a network. The vulnerability affects multiple version ranges of Microsoft 365 Apps for Enterprise prior to fixed versions. The CVSS 3.1 base score is 8.8 (high), with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are currently reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely without privileges, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires user interaction but no authentication, increasing its risk in network-exposed environments. However, no active exploitation has been reported so far.

An official fix is available from Microsoft. Users and administrators should apply the security updates as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78524. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation actions are required beyond applying the official fix.