CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-70145 is an out-of-bounds read vulnerability in the Microsoft Windows Search Component affecting multiple versions of Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information. The vulnerability has been assigned a medium severity with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-69381 is an out-of-bounds read vulnerability in the Windows Storage Port Driver affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an unauthorized attacker with physical access to the system to disclose sensitive information. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in specific updates.

CVE-2026-81957 is a high-severity vulnerability in Microsoft 365 Apps for Enterprise, specifically in Microsoft Office Excel. It involves an out-of-bounds read (CWE-125) that could allow an unauthorized attacker to execute code locally. The vulnerability affects multiple versions prior to fixed releases. Microsoft has issued official fixes for the affected versions.

CVE-2026-81395 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official fixes have been released by Microsoft to address this issue.

CVE-2026-81400 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A patch is available and has been officially released by Microsoft.

CVE-2026-81393 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A patch is available and has been officially released by Microsoft. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-81956 is a high-severity vulnerability in Microsoft 365 Apps for Enterprise, specifically an out-of-bounds read in Microsoft Excel. This flaw allows an unauthorized attacker to execute code locally on the affected system. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to their respective fixed versions. An official fix is available from Microsoft.

CVE-2026-81392 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in multiple versions of the software.

CVE-2026-81390 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information by reading memory outside the intended bounds. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A patch addressing this issue is officially available from Microsoft.

CVE-2026-80096 is an out-of-bounds read vulnerability in Microsoft Windows 10 Version 1607 Remote Desktop Services. It allows an authorized attacker to elevate privileges over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. A high-severity CVSS 3.1 score of 8.8 reflects the critical impact on confidentiality, integrity, and availability. Official patches have been released by Microsoft to address this issue.

CVE-2026-80082 is an out-of-bounds read vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple versions prior to fixed releases in 16.0.20326.20138, 16.0.10417.20207, 16.113.26091433, 16.0.14334.20906, and 16.0.17932.20976. The vulnerability has a medium severity rating with a CVSS score of 6.5. Microsoft has issued official fixes for the affected versions. No known exploits are reported in the wild at this time.

CVE-2026-80090 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Microsoft has released official fixes for affected versions.

CVE-2026-80089 is an out-of-bounds read vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple versions prior to fixed releases. A patch is available from Microsoft to address this issue.

CVE-2026-80088 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has been assigned a CVSS v3.1 score of 6.5, indicating a medium severity level. Official fixes have been released by Microsoft in multiple versions of the product.

CVE-2026-80086 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) and requires user interaction but no privileges. Multiple affected versions prior to fixed releases are identified. An official fix is available from Microsoft.

CVE-2026-80084 is an out-of-bounds read vulnerability in Microsoft Office Outlook, part of Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple versions prior to fixed releases in 16.0.x builds. A patch is available and has been officially released by Microsoft.

CVE-2026-80076 is an out-of-bounds read vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple versions prior to fixed releases in 16.x and 16.113 branches. Microsoft has released official fixes for the affected versions. The vulnerability has a medium severity rating with a CVSS score of 6.5 and requires user interaction but no privileges. There are no known exploits in the wild at this time.

CVE-2026-80078 is an out-of-bounds read vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple versions prior to fixed releases. It has a medium severity score of 6.5 and requires user interaction for exploitation. Microsoft has released official fixes for the affected versions.

CVE-2026-78520 is an out-of-bounds read vulnerability in Microsoft Office Outlook, part of Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability.

CVE-2026-78522 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple versions prior to specific fixed releases. A patch is available and has been officially released by Microsoft.