CVE-2026-83949: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-83949) involves a buffer over-read in Microsoft Office Word within Microsoft 365 Apps for Enterprise. An unauthorized attacker can exploit this flaw to disclose information locally on the affected system. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no privileges, but user interaction is required. The impact is confidentiality loss without integrity or availability impact. Microsoft has published an official fix addressing this issue.

Successful exploitation allows an attacker to read memory beyond the intended buffer boundaries, potentially disclosing sensitive information locally. The vulnerability does not affect integrity or availability. No known active exploits have been reported.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83949. No additional mitigation steps are indicated by the vendor.