CVE-2026-88150: CWE-908: Use of Uninitialized Resource in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88150) is classified as CWE-908 (Use of Uninitialized Resource) affecting Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows remote code execution by exploiting uninitialized resources. The CVSS 3.1 base score is 8.8, with attack vector network, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected versions include multiple specific builds of Microsoft 365 Apps for Enterprise as listed.

Successful exploitation could allow an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This poses a high risk to users of Microsoft 365 Apps for Enterprise until patched.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft security update advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88150 to ensure their environments are updated and protected.