CVE-2026-80076: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-80076) involves an out-of-bounds read in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to disclose sensitive information remotely over a network. The flaw is classified under CWE-125. The vulnerability affects several version ranges of Microsoft 365 Apps for Enterprise prior to fixed versions. Microsoft has released an official fix for this issue and manages remediation for this cloud-hosted service. No active exploitation has been reported.

An attacker exploiting this vulnerability could gain unauthorized access to information by causing the application to read memory outside of its intended bounds. This could lead to the disclosure of sensitive data over a network. There is no impact on integrity or availability reported. The vulnerability requires no privileges and user interaction is required.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80076. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation actions are required beyond applying the official fix.