CVE-2026-80091: CWE-908: Use of Uninitialized Resource in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-80091) involves the use of an uninitialized resource in Microsoft Office components within Microsoft 365 Apps for Enterprise. The flaw allows an unauthorized attacker to potentially disclose sensitive information over a network. The issue affects various versions of Microsoft 365 Apps for Enterprise prior to fixed versions identified by Microsoft. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. Microsoft has released an official fix and manages remediation for this cloud service.

An attacker could exploit this vulnerability to disclose sensitive information over a network without requiring privileges but with user interaction. The confidentiality impact is high, while integrity and availability impacts are none. There are no known active exploits in the wild.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the available updates as provided by Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Check the Microsoft Security Response Center advisory for the latest update and patch status.