CVE-2026-80078: Microsoft 365 Apps Information Disclosure

CVE-2026-80078 Overview

CVE-2026-80078 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple supported Office releases including Microsoft 365 Apps, Office 2019, Office 2021, and Office 2024 across Windows and macOS. Exploitation requires the target user to open a crafted document, but no authentication is needed. Successful exploitation exposes memory contents that can include sensitive data such as heap addresses, document fragments, or cryptographic material useful for follow-on attacks.

Critical Impact
An attacker who convinces a user to open a malicious Office file can read memory outside intended boundaries and exfiltrate sensitive information over the network without any privileges on the target system.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-80078 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80078

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] within Microsoft Office parsing code. When Office processes a specially crafted document, the affected routine reads memory past the end of an allocated buffer. That adjacent memory can contain unrelated process data, which is then reflected back through the document rendering or an outbound network channel controlled by the attacker.

The issue affects confidentiality only. Integrity and availability of the host remain intact, and code execution does not occur as a direct consequence of the read. However, disclosed memory can accelerate exploitation of separate vulnerabilities by defeating Address Space Layout Randomization (ASLR) or by leaking authentication material.

At time of publication, no public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.692%, placing it near the 51st percentile of scored CVEs.

Root Cause

The root cause is missing or insufficient bounds checking when Office parses a structured field within a document format. The parser trusts an attacker-controlled length or offset value and reads memory beyond the allocated object. Microsoft has not publicly disclosed the specific file format or parsing component affected.

Attack Vector

The attack vector is network-based with user interaction required. An attacker delivers a crafted Office document by email, web download, or collaboration platform. When the victim opens the file, the vulnerable parser reads out-of-bounds memory and returns disclosed content to a location the attacker can observe, such as an embedded remote resource reference.

A public proof-of-concept for CVE-2026-80078 has not been released. Refer to the Microsoft Security Update Guide for technical remediation details.

Detection Methods for CVE-2026-80078

Indicators of Compromise

Office documents received from untrusted sources that trigger outbound network connections to unfamiliar hosts on open.
Unexpected winword.exe, excel.exe, or powerpnt.exe child processes or DNS lookups following document open events.
Office application crashes or memory access exceptions logged in the Windows Application event log after document activity.

Detection Strategies

Inspect inbound email attachments and file-sharing traffic for Office documents containing external references, remote templates, or unusual embedded objects.
Correlate document-open telemetry with outbound HTTP, SMB, or WebDAV connections originating from Office processes.
Deploy YARA rules and file-format scanners that flag anomalous structure fields commonly used in Office file parsing exploits.

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction rules that block Office from creating child processes and from making outbound connections to untrusted destinations.
Forward Office process telemetry, DNS logs, and email gateway logs to a central SIEM for correlated hunting on document-borne activity.
Track patch deployment status for Microsoft 365 Apps, Office 2019, 2021, and 2024 across the fleet to confirm coverage.

How to Mitigate CVE-2026-80078

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations.
Prioritize patching for users who routinely open documents from external senders, including finance, HR, legal, and executive assistants.
Confirm Microsoft 365 Apps update channels are current and that macOS Office installations have received the corresponding build.

Patch Information

Microsoft has released updates addressing CVE-2026-80078 for Microsoft 365 Apps (x64 and x86 Enterprise), Microsoft 365 for macOS, Office 2019, Office 2021 LTSC (Windows and macOS), and Office 2024 LTSC (Windows and macOS). Refer to the Microsoft Security Update Guide for build numbers and deployment guidance specific to each channel.

Workarounds

Enable Protected View and Office Application Guard so untrusted documents open in an isolated container that limits information disclosure.
Block or quarantine Office documents from external senders at the mail gateway until patches are deployed enterprise-wide.
Disable automatic download of linked images and remote content in Office to reduce covert exfiltration channels available to a crafted document.

bash

# Configuration example: disable automatic external content in Office via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Common\Security" /v "DisableAllActiveX" /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security" /v "BlockContentExecutionFromInternet" /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Common\Internet" /v "UseOnlineContent" /t REG_DWORD /d 0 /f