CVE-2026-94506: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability involves an out-of-bounds read in Microsoft Office Access, part of Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to disclose sensitive information remotely. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability affects versions =16.0.1, >=16.0.1 <16.0.14334.20974, and >=16.0.0 <16.0.17932.21056. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker exploiting this vulnerability can read memory outside the intended bounds, potentially disclosing sensitive information over the network without requiring privileges. The impact is confidentiality loss only, with no integrity or availability impact reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94506 to ensure their environments are updated and protected.