CVE-2026-81400: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81400) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw permits an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS 3.1 base score is 5.5, reflecting medium severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker can leverage this vulnerability to read memory beyond intended boundaries in Excel, potentially disclosing sensitive information locally. There is no impact on integrity or availability. The attack requires local access and user interaction.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided updates as detailed in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81400. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation actions are required beyond applying the official fix.