CVE-2026-88192: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88192) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to read memory beyond intended boundaries, potentially disclosing sensitive information over a network. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix for this vulnerability. The affected versions include =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, and =16.0.0.

An attacker can exploit this vulnerability remotely over a network to disclose sensitive information from the affected Microsoft Excel application. The impact is limited to confidentiality loss; there is no impact on integrity or availability. No known active exploits exist in the wild.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the available patches as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88192. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Ensure that all affected versions are updated to patched releases.