CVE-2026-88172: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-88172 is a CWE-125 out-of-bounds read vulnerability affecting Microsoft Office Excel in Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to read memory beyond the intended bounds, potentially disclosing sensitive information over a network. The vulnerability affects specific versions of Microsoft 365 Apps for Enterprise, including exactly version 16.0.1 and ranges from 16.0.1 up to but not including 16.0.14334.20974, and from 16.0.0 up to but not including 16.0.17932.21056. Microsoft has published an official fix for this issue, and the vulnerability is tracked under CVE-2026-88172 with a CVSS v3.1 score of 6.5 (medium severity).

An attacker who successfully exploits this vulnerability can cause an out-of-bounds read in Microsoft Excel, leading to unauthorized disclosure of information over a network. The impact is limited to confidentiality as there is no integrity or availability impact reported. No known active exploitation has been observed.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the provided security updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88172. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are required beyond applying the official patch.