CVE-2026-81395: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-81395 is a vulnerability classified as CWE-125 (Out-of-bounds Read) affecting Microsoft Office Excel in Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information locally. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

The vulnerability enables an unauthorized attacker to perform an out-of-bounds read in Microsoft Excel, leading to local information disclosure. There is no indication of integrity or availability impact. No known exploitation in the wild has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81395 for update and patch deployment guidance.