CVE-2026-80088: Microsoft 365 Apps Information Disclosure

CVE-2026-80088 Overview

CVE-2026-80088 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word. The flaw allows an unauthorized remote attacker to disclose information by tricking a user into opening a specially crafted document. Successful exploitation exposes memory contents from the Word process, which may contain sensitive data.

The vulnerability affects Microsoft 365 Apps, Microsoft 365, and Office 2016, 2019, 2021, and 2024 on both Windows and macOS. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
Remote attackers can disclose confidential in-process memory from Microsoft Word when a user opens a malicious document, potentially leaking credentials, document contents, or ASLR-related pointers useful for chaining further exploits.

Affected Products

Microsoft 365 Apps (x86 and x64, Enterprise)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS variants)

Discovery Timeline

2026-09-08 - CVE-2026-80088 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80088

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] within Microsoft Office Word's document parsing logic. When Word processes a malformed document, it reads memory outside the bounds of an allocated buffer. The read data can be returned to the attacker through document rendering artifacts, embedded scripting, or other content channels controlled by the crafted file.

Because exploitation requires user interaction, an attacker typically delivers the malicious document through phishing, a compromised website, or a shared file service. Once opened, the parser dereferences attacker-influenced offsets and exposes adjacent process memory. The impact is limited to confidentiality; integrity and availability of the host are not directly affected.

Root Cause

The root cause is missing or incorrect bounds validation on a length or index field within a Word document structure. Microsoft has not published low-level technical details in the public advisory. Refer to the Microsoft Security Update Guide for authoritative patch and version data.

Attack Vector

Attack delivery occurs over the network through a document lure. The victim must open the crafted .docx, .doc, or related Word file for the read primitive to trigger. Exploitation does not require elevated privileges on the target system, and the disclosed memory contents can be exfiltrated through follow-on channels controlled by the document.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-80088

Indicators of Compromise

Inbound email attachments containing Word documents from untrusted or spoofed senders, particularly with unusual embedded objects or malformed OOXML structures.
Word process (WINWORD.EXE) generating anomalous outbound network connections shortly after document open.
Unexpected child processes spawned by Word following the opening of a document from an internet-derived path (Mark-of-the-Web tagged).

Detection Strategies

Deploy behavioral endpoint detection to flag Word processes exhibiting anomalous memory access patterns or crashes triggered by document opens.
Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links to detonate suspicious documents before delivery.
Correlate email gateway telemetry with endpoint document-open events to identify targeted lures.

Monitoring Recommendations

Monitor WINWORD.EXE for outbound HTTP/HTTPS connections to newly observed domains within 60 seconds of a document open.
Track Windows Error Reporting (WerFault.exe) events referencing Word to identify parsing crashes that may indicate exploitation attempts.
Audit Office telemetry for documents sourced from internet zones and opened outside of Protected View.

How to Mitigate CVE-2026-80088

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide for all affected Office channels.
Enforce Protected View for documents originating from the internet and other untrusted locations.
Restrict macro execution and block macros in files from the internet through Group Policy.

Patch Information

Microsoft has released security updates through its standard servicing channels for Microsoft 365 Apps, Microsoft 365, and Office 2016, 2019, 2021 LTSC, and 2024 LTSC. Consult the Microsoft Security Update Guide for the specific build numbers required to remediate CVE-2026-80088 on each channel and platform.

Workarounds

Configure Office File Block policy to prevent opening of legacy Word document formats from untrusted locations until patches are deployed.
Route inbound Office attachments through a sandboxed detonation service before delivery to users.
Educate users to open unexpected Word documents only in Protected View or Office for the web, which isolates the parser from local memory.

bash

# Group Policy registry example: enforce Protected View for internet-sourced files
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f