CVE-2026-80089: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CWE-125 (Out-of-bounds Read), exists in Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to perform an out-of-bounds read, potentially disclosing sensitive information over a network. The vulnerability affects several version ranges of Microsoft 365 Apps for Enterprise prior to fixed versions. Microsoft has published an official security update addressing this issue.

An attacker without privileges can exploit this vulnerability to disclose information over a network. The impact is limited to confidentiality as there is no indication of integrity or availability impact. No known active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80089. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Check the vendor advisory for confirmation and further guidance.