CVE-2026-88196: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88196) is a heap-based buffer overflow in Microsoft Office within Microsoft 365 Apps for Enterprise. It enables an attacker to execute arbitrary code remotely without privileges, requiring user interaction. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages patching for the cloud service. The affected versions include multiple specific builds of Microsoft 365 Apps for Enterprise prior to fixed versions.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of the affected system. The vulnerability affects confidentiality, integrity, and availability of the impacted environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the vendor's updates as recommended in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88196.