CVE-2026-80082: Microsoft 365 Apps Information Disclosure

CVE-2026-80082 Overview

CVE-2026-80082 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that allows an unauthorized remote attacker to disclose sensitive information. The flaw affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021, and Office 2024 across x86, x64, and macOS builds. Exploitation requires user interaction, typically opening a crafted document delivered by email or hosted on an attacker-controlled site. Successful exploitation can leak process memory contents that may include document data, session artifacts, or memory addresses useful for further attacks.

Critical Impact
An attacker who convinces a user to open a specially crafted Office document can read memory outside of intended buffers, disclosing sensitive information over the network.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft 365 for macOS, Microsoft Office 2019 (x86 and x64)
Microsoft Office 2021 LTSC and Office 2024 LTSC (x86, x64, and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-80082 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80082

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] within Microsoft Office file parsing routines. When Office processes a malformed document, parsing logic reads memory beyond the bounds of an allocated buffer. The out-of-range data is then reflected back into structures accessible to the attacker, enabling information disclosure. The flaw affects confidentiality only; integrity and availability of the host remain intact according to the published vector. Because the attack surface is document parsing, delivery mechanisms include phishing attachments, malicious downloads, and documents rendered through Office web protocol handlers.

Root Cause

The root cause is missing or insufficient bounds checking during the parsing of structured document content. Office reads a length or offset field from attacker-controlled input and dereferences memory without validating that the target address falls within the intended buffer. Adjacent heap or stack memory is then returned to a code path that exposes it to the attacker.

Attack Vector

Exploitation occurs over the network with user interaction required. A target must open a crafted Office document, typically delivered through email, cloud file shares, or web download. No authentication is needed on the target system. The attacker cannot modify files or crash the application through this flaw alone, but leaked memory contents can be chained with other vulnerabilities to achieve code execution or bypass address space layout randomization (ASLR).

No public proof-of-concept code is available at the time of publication. Refer to the Microsoft Security Update Guide for CVE-2026-80082 for vendor-supplied technical detail.

Detection Methods for CVE-2026-80082

Indicators of Compromise

Office documents with unusual embedded objects, malformed structured storage streams, or oversized length fields in header records.
Inbound email attachments and cloud-shared documents from untrusted senders that trigger Office processes to make outbound network connections shortly after opening.
Crash telemetry or Windows Error Reporting events from winword.exe, excel.exe, or powerpnt.exe referencing access violations during file open.

Detection Strategies

Enable Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from making outbound network connections when opening untrusted content.
Monitor endpoint telemetry for Office processes spawning mshta.exe, powershell.exe, cmd.exe, or unusual network sockets immediately after document open events.
Deploy YARA rules or content inspection at the mail gateway that identify malformed OOXML, RTF, or compound document structures with anomalous size fields.

Monitoring Recommendations

Aggregate Office process telemetry, document open events, and outbound network flows in a central log platform for correlation.
Alert on repeated Office application crashes across multiple endpoints originating from documents with a shared hash or sender.
Track EPSS and vendor advisory updates for CVE-2026-80082 to reprioritize response as exploitation likelihood shifts.

How to Mitigate CVE-2026-80082

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-80082 to all affected Office channels, including Windows and macOS builds, using standard patch management tooling.
Enforce Protected View and Office Application Guard for documents originating from the internet, email attachments, and unsafe locations.
Communicate phishing awareness guidance to users, emphasizing caution with unexpected attachments and links to external documents.

Patch Information

Microsoft has published the fix through the Microsoft Security Update Guide. See the Microsoft Security Vulnerability advisory for CVE-2026-80082 for update packages covering Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, and Office 2024 LTSC.

Workarounds

Block or quarantine Office document types at the mail gateway when senders are outside trusted domains, pending patch deployment.
Configure Group Policy to force Protected View for files from the internet, Outlook attachments, and unsafe locations, disabling the ability for users to exit Protected View for untrusted content.
Restrict Office add-ins and macros through the Trust Center to reduce the attack surface for weaponized documents.

bash

# Example Group Policy registry keys to enforce Protected View for Word
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f