CVE-2026-88169: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-88169 is an out-of-bounds read vulnerability (CWE-125) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. This vulnerability enables an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The CVSS 3.1 base score is 6.5, indicating medium severity, with attack vector network, low attack complexity, no privileges required, and user interaction required. The vulnerability affects specific versions including =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, and =16.0.0. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an unauthorized attacker to read memory outside the intended boundaries, leading to information disclosure over a network. There is no impact on integrity or availability reported. The medium severity reflects the potential for sensitive data exposure without requiring privileges but does require user interaction.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88169. Since this is a cloud-hosted service, Microsoft manages remediation server-side. There are no known exploits in the wild, so applying the official fix is the recommended mitigation.