CVE-2026-80084: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-80084) involves an out-of-bounds read in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. An attacker without privileges can exploit this flaw to read memory beyond intended boundaries, potentially disclosing sensitive information over a network. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed builds. Microsoft has published an official fix and recommends applying the update to remediate the issue.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information over a network. There is no indication of impact on integrity or availability. No known active exploitation in the wild has been reported.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80084. Since this is a cloud service, Microsoft manages remediation for cloud-hosted components. No additional mitigation steps are indicated by the vendor.