CVE-2026-88184: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-88184 is an out-of-bounds read vulnerability (CWE-125) affecting Microsoft Office Excel in Microsoft 365 Apps for Enterprise. The vulnerability enables an unauthorized attacker to read memory beyond the intended bounds, potentially disclosing sensitive information over a network. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of information over a network. There is no indication of integrity or availability impact. The vulnerability requires user interaction but no privileges or authentication.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88184.