CVE-2026-80087: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-80087) is a heap-based buffer overflow in Microsoft 365 Apps for Enterprise that could allow an unauthorized attacker to disclose information over a network. The CVSS 3.1 vector indicates the attack requires network access with low complexity, no privileges, and user interaction, impacting confidentiality but not integrity or availability. Multiple version ranges of Microsoft 365 Apps for Enterprise are affected, with official fixes released by Microsoft. The vendor advisory confirms the availability of an official fix and that this is a cloud service with vendor-managed remediation.

An attacker can exploit this vulnerability remotely without privileges but requires user interaction to disclose sensitive information from the affected Microsoft 365 Apps for Enterprise. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the provided updates as per the Microsoft Security Response Center advisory. Since this is a cloud service, Microsoft manages remediation server-side for cloud-hosted instances. Check the vendor advisory for the latest update status and deployment guidance.