CVE-2026-88195: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88195) involves a buffer over-read in Microsoft Office Excel component of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw remotely without privileges but requires user interaction to disclose sensitive information over a network. The vulnerability is identified as CWE-126 (Buffer Over-read). The CVSS 3.1 base score is 6.5, indicating medium severity. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information over a network. There is no impact on integrity or availability. The attacker does not require privileges but does require user interaction to trigger the vulnerability.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance. Refer to the Microsoft Security Response Center advisory for detailed patching instructions.