CVE-2026-81399: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81399) involves a buffer over-read in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. An attacker with local access and no privileges can cause Excel to read beyond the intended buffer boundaries, potentially disclosing sensitive information locally. The vulnerability is classified under CWE-126 (Buffer Over-read). The CVSS 3.1 base score is 5.5 (medium), with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An attacker with local access and user interaction can exploit this vulnerability to disclose sensitive information from memory. There is no impact on integrity or availability. The vulnerability does not require elevated privileges but does require the user to open a malicious file or otherwise interact with the application locally.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as provided by Microsoft. Since this is a cloud-managed service, Microsoft manages remediation server-side. Check the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81399 for the latest update status and guidance.