CVE-2026-88201: CWE-126: Buffer Over-read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88201) involves a buffer over-read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw to disclose information remotely without privileges but requires user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. Microsoft has published an official fix to address this issue.

Successful exploitation can lead to unauthorized disclosure of information over a network. There is no impact on integrity or availability. No known active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88201. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are specified by the vendor.