CVE-2026-97760: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability involves an out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise, which could allow an unauthorized attacker to disclose sensitive information over a network. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. The vulnerability affects multiple specific versions of Microsoft 365 Apps for Enterprise as listed. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation can lead to unauthorized disclosure of information over a network. There is no impact on integrity or availability reported. The vulnerability requires user interaction but no privileges or authentication, making it a moderate risk for information leakage.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation on their side. Users and administrators should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97760 for detailed patching and mitigation instructions.