CVE-2026-97779: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

An out-of-bounds read vulnerability (CWE-125) exists in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. This vulnerability could allow an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to the official fixes. Microsoft has published an advisory with an official fix available.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of information over a network. There is no impact on integrity or availability. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97779. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Ensure all affected versions are updated to the fixed versions.