CVE-2026-80078: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability involves an out-of-bounds read in Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to disclose sensitive information over a network. The issue is tracked as CWE-125 and affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed versions. Microsoft has released an official fix for this vulnerability and manages remediation for the cloud service. The CVSS 3.1 base score is 6.5, indicating medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality.

An attacker exploiting this vulnerability can read memory outside the intended bounds, potentially disclosing sensitive information over a network. The vulnerability does not impact integrity or availability. No known active exploitation has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80078 for detailed patching guidance and ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed versions.