CVE-2026-88167: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88167) involves a buffer over-read in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information remotely without requiring privileges but does require user interaction. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has published an official fix and manages remediation for this cloud service.

The vulnerability allows unauthorized remote attackers to disclose sensitive information by exploiting a buffer over-read condition in Microsoft Office Word. There is no impact on integrity or availability. Exploitation requires user interaction. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88167 to mitigate this vulnerability.