CVE-2026-88151: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88151) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information remotely over a network. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix for this vulnerability. The affected versions include exactly 16.0.1, versions from 16.0.1 up to but not including 16.0.14334.20974, and versions from 16.0.0 up to but not including 16.0.17932.21056.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information over a network. There is no impact on integrity or availability. The attacker does not require privileges but does require user interaction. No known exploits are currently reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88151. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are specified.