CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-97760 is an out-of-bounds read vulnerability in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Microsoft has issued official fixes for affected versions. No known exploits are reported in the wild.

CVE-2026-97779 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Microsoft has issued official fixes for this vulnerability in multiple versions of the product.

CVE-2026-69675 is an out-of-bounds read vulnerability in the Windows Network File System component of Microsoft Windows Server 2012 and related versions. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity with a CVSS score of 5.5 and does not impact integrity or availability. Official patches have been released to address this issue.

CVE-2026-96930 is an out-of-bounds read vulnerability in the Windows Universal Disk Format File System Driver (UDFS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity score of 5.5 and has been officially fixed in various Windows 10 builds.

CVE-2026-96927 is an out-of-bounds read vulnerability in the Windows NTFS component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue across all affected versions.

CVE-2026-96846 is an out-of-bounds read vulnerability in the WebDAV component of Microsoft Windows 10 Version 1607 and related builds. It allows an authorized attacker with local access to disclose information. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. A patch is available from Microsoft to address this issue.

CVE-2026-96321 is an out-of-bounds read vulnerability in the Remote Desktop Display Driver component of Microsoft Windows 10 Version 21H2. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for affected versions.

CVE-2026-96232 is an out-of-bounds read vulnerability in the Microsoft .NET 10.0 runtime that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple versions of the .NET runtime prior to their respective fixed releases. This vulnerability has a high severity score and has been officially fixed by Microsoft.

CVE-2026-88190 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has been assigned a medium severity with a CVSS score of 6.5. Microsoft has issued official fixes for affected versions.

CVE-2026-88192 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. Official fixes have been released in versions 16.114.26101123, 16.0.14334.20974, and 16.0.17932.21056. No known exploits are reported in the wild. Microsoft manages remediation for this cloud-hosted service and has provided an official fix.

CVE-2026-88183 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Official fixes have been released in versions 16.114.26101123, 16.0.14334.20974, and 16.0.17932.21056. No known exploits are reported in the wild at this time.

CVE-2026-88184 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Microsoft has released official fixes for affected versions. No known exploits are reported in the wild.

CVE-2026-88172 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has been assigned a CVSS v3.1 score of 6.5, indicating a medium severity level. Official fixes have been released in versions 16.0.14334.20974 and 16.0.17932.21056. No known exploits in the wild have been reported. Microsoft manages remediation for this cloud-hosted service and has provided an official fix.

CVE-2026-88154 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. Official patches have been released by Microsoft to address this issue.

CVE-2026-70281 is an out-of-bounds read vulnerability in Microsoft Office Outlook, part of Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network without requiring user interaction or privileges. The vulnerability has a high severity score of 7.5 and affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability.

CVE-2026-70219 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity) and requires user interaction to exploit. Official fixes have been released in versions 16.0.14334.20974 and 16.0.17932.21056.

CVE-2026-70254 is a high-severity out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions of the software prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability.

CVE-2026-70214 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information. The vulnerability has a medium severity score of 5.5 and requires user interaction to exploit. Official patches have been released by Microsoft to address this issue.

CVE-2026-69919 is an out-of-bounds read vulnerability in Windows Cryptographic Services affecting Microsoft Windows 11 Version 24H2. It allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity with a CVSS score of 5.5. Microsoft has released official fixes for affected versions.

CVE-2026-88130 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows Server 2012 and related versions. This flaw allows an authorized attacker to cause a denial of service (DoS) over a network by exploiting the improper memory access. The vulnerability affects multiple Windows Server versions prior to specific fixed releases. A patch is available from Microsoft to address this issue.