CVE-2026-80073: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-80073) involves an out-of-bounds read in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. An attacker without privileges can exploit this flaw to disclose sensitive information over a network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation can lead to unauthorized disclosure of information over a network, potentially exposing sensitive data. There is no impact on integrity or availability reported. The vulnerability requires user interaction but no privileges, making it a moderate risk.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise are updated to the fixed versions as per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80073.