CVE-2026-80079: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-80079) involves an out-of-bounds read in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. The flaw enables unauthorized attackers to read memory beyond intended bounds, potentially disclosing sensitive information over a network. The CVSS 3.1 base score is 6.5, with attack vector network, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has published an official fix and manages remediation for this cloud service. Multiple affected version ranges are identified, all fixed in later builds.

An attacker exploiting this vulnerability can disclose sensitive information remotely without requiring privileges but does require user interaction. The impact is limited to confidentiality loss; integrity and availability are not affected. No known active exploitation is reported.

An official fix is available from Microsoft. Microsoft manages remediation for this cloud-hosted service, so users should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed versions as per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80079.