CVE-2026-80080: CWE-415: Double Free in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-80080 is a double free vulnerability (CWE-415) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. The flaw allows remote code execution by an unauthorized attacker over a network. The vulnerability affects multiple version ranges of Microsoft 365 Apps for Enterprise prior to fixed versions. Microsoft has published an official fix and manages remediation for this cloud service. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction required. Confidentiality, integrity, and availability impacts are all high.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected systems, leading to full compromise of confidentiality, integrity, and availability of the impacted Microsoft 365 Apps for Enterprise environment. This could enable attacker control over the affected application and potentially the underlying system.

An official fix is available from Microsoft. Users and administrators should apply the latest updates as provided in the Microsoft security update guide for CVE-2026-80080. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Check the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80080 for current patch status and deployment instructions. No additional mitigation actions are required beyond applying the official fix.