CVE-2026-80084: Microsoft 365 Apps Information Disclosure

CVE-2026-80084 Overview

CVE-2026-80084 is an out-of-bounds read vulnerability [CWE-125] affecting Microsoft Office Outlook across multiple supported Office versions. An unauthenticated remote attacker can trigger the flaw to disclose information from process memory over a network. Successful exploitation requires user interaction, such as opening or previewing a specially crafted email or document. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

The issue affects Microsoft 365 Apps, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on both x86 and x64 architectures. No public proof-of-concept exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact

Attackers can read out-of-bounds memory in Outlook to disclose sensitive process data, including potential fragments of message content, tokens, or memory pointers useful for further exploitation.

Affected Products

• Microsoft 365 Apps (x86 and x64, Enterprise)
• Microsoft Office 2016, 2019, 2021 LTSC (x86 and x64)
• Microsoft Office 2024 LTSC (x86 and x64)

Discovery Timeline

• 2026-09-08 - CVE-2026-80084 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80084

Vulnerability Analysis

The vulnerability is an out-of-bounds read within Microsoft Office Outlook's parsing logic. When Outlook processes a crafted input, it reads memory beyond the intended buffer boundary. The out-of-bounds bytes are then handled by application logic and can be returned to the attacker through network-observable behaviors or reflected content.

The attack requires user interaction, typically opening or previewing a malicious message. The confidentiality impact is high, while integrity and availability are unaffected. This pattern is consistent with parsers that trust attacker-controlled length or offset fields without validating them against actual buffer sizes.

Because the flaw discloses memory contents rather than granting code execution directly, attackers commonly chain it with memory corruption bugs. The leaked pointers or heap contents can defeat Address Space Layout Randomization (ASLR) and enable follow-on exploits.

Root Cause

The root cause is missing or insufficient bounds checking when Outlook reads structured fields from an untrusted message or attachment. A parser dereferences a length or index derived from attacker input, causing reads past the end of an allocated buffer. See the Microsoft CVE-2026-80084 Advisory for vendor-confirmed technical details.

Attack Vector

The attack vector is network-based. An attacker delivers a crafted email or embedded object to a target Outlook client. When the user opens or previews the item, Outlook parses the malformed structure and reads out-of-bounds memory. The leaked data can be exfiltrated through reply channels, remote content requests, or other message-processing side effects.

No verified proof-of-concept code is available for CVE-2026-80084. Refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-80084

Indicators of Compromise

• Inbound emails containing malformed MIME structures, oversized headers, or crafted attachment metadata targeting Outlook parsers.
• Outlook processes generating unexpected outbound network requests to unknown domains immediately after message rendering.
• Application crashes or exception events referencing outlook.exe shortly after receipt of specific messages.

Detection Strategies

• Inspect mail flow at the gateway for messages with anomalous structural fields, malformed TNEF, or unusual attachment types associated with Office parsing.
• Correlate endpoint telemetry from outlook.exe with parent-child process creation and network egress patterns following message preview events.
• Deploy YARA-style content rules against message stores to identify crafted payloads matching known exploit signatures once published by Microsoft.

Monitoring Recommendations

• Monitor Windows Error Reporting (WER) and Application event logs for repeated outlook.exe faults referencing memory access violations.
• Alert on Outlook client versions that remain unpatched against the September 2026 Microsoft security update baseline.
• Track EPSS scoring changes and MSRC updates for CVE-2026-80084 to reprioritize response as exploitation likelihood shifts.

How to Mitigate CVE-2026-80084

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-80084 to all affected Microsoft 365 Apps and Office 2016/2019/2021/2024 installations.
• Inventory Office versions across managed endpoints and prioritize systems handling external mail flows.
• Enable Protected View and disable the Outlook reading pane for high-risk users until patching completes.

Patch Information

Microsoft has published patch details in the Microsoft CVE-2026-80084 Advisory. Administrators should deploy the corresponding update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Microsoft Configuration Manager. Microsoft 365 Apps receive updates through the Click-to-Run channel and should be validated at the current cumulative build.

Workarounds

• Disable automatic message preview and force plain-text reading mode for untrusted senders through Outlook Group Policy.
• Restrict rich content and remote image loading in Outlook to reduce parser exposure to attacker-controlled data.
• Use mail gateway filtering to strip or quarantine attachments and message parts that trigger malformed structure heuristics.

# Configuration example: enforce plain-text reading via Group Policy registry key
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Outlook\Options\Mail" /v ReadAsPlain /t REG_DWORD /d 1 /f