CVE-2026-97014: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97014) involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw permits unauthorized local information disclosure. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low complexity, no privileges required, and user interaction needed. Microsoft has published an official fix for affected versions.

The vulnerability allows an unauthorized attacker to read memory outside the intended bounds in Microsoft Excel, potentially disclosing sensitive information locally. There is no indication of integrity or availability impact. Exploitation requires local access and user interaction. No known exploits are reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97014 for update details and guidance.