CVE-2026-88175: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88175) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information remotely over a network. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation can lead to unauthorized disclosure of information over a network, impacting confidentiality. There is no impact on integrity or availability. The vulnerability requires user interaction but no privileges or authentication.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as recommended in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88175 to mitigate this vulnerability.