CVE-2026-80088: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-80088 is an out-of-bounds read vulnerability (CWE-125) in Microsoft Office Word as part of Microsoft 365 Apps for Enterprise. This vulnerability enables an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The issue affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed builds. Microsoft has released an official fix for this vulnerability and manages remediation for the cloud service. No known exploits are reported in the wild.

An attacker exploiting this vulnerability can disclose sensitive information remotely without requiring privileges, but user interaction is required. The impact is limited to confidentiality, with no integrity or availability impact reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as indicated in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80088 to mitigate this vulnerability.