CVE-2026-83951: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-83951) involves a buffer over-read in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. The flaw allows an unauthorized attacker to cause information disclosure on the local system. The CVSS 3.1 base score is 5.5, indicating medium severity, with an attack vector requiring local access and user interaction. The vulnerability affects multiple version ranges of Microsoft 365 Apps for Enterprise prior to various fixed builds. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

An attacker with local access and the ability to trick a user into interacting with a malicious file could exploit this vulnerability to read sensitive information from memory, leading to information disclosure. There is no impact on integrity or availability. The vulnerability does not require elevated privileges but does require user interaction.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83951. Since this is a cloud service, Microsoft manages remediation server-side for cloud-hosted components. No additional mitigation actions are required beyond applying the official fix.