CVE-2026-80089: Microsoft 365 Apps Information Disclosure

CVE-2026-80089 Overview

CVE-2026-80089 is an out-of-bounds read vulnerability [CWE-125] affecting multiple versions of Microsoft Office. The flaw allows an unauthorized remote attacker to disclose sensitive information over a network when a user opens a specially crafted Office document. Exploitation requires user interaction, but no authentication or elevated privileges. The vulnerability impacts confidentiality without affecting integrity or availability of the target system. Microsoft published an advisory in the Microsoft Security Response Center guide, and affected products span Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021, and 2024 LTSC editions on Windows and macOS.

Critical Impact
A remote attacker can read memory beyond an allocated buffer in Microsoft Office, disclosing sensitive process memory contents when a user opens a crafted document.

Affected Products

Microsoft 365 Apps (x64 and x86 Enterprise)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS where applicable)

Discovery Timeline

2026-09-08 - CVE-2026-80089 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80089

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office file parsing routines. When Office processes a malformed document, the parser reads memory outside the bounds of an allocated buffer. The disclosed memory can contain sensitive data from the Office process, including document contents, cached credentials, or fragments useful for bypassing memory protections such as Address Space Layout Randomization (ASLR).

The attack is network-based because the malicious document can be delivered via email, chat, or web download. However, the user must open the file for exploitation to succeed. The vulnerability affects only confidentiality — the process integrity and availability remain intact after a successful read.

Root Cause

The root cause is missing or insufficient bounds checking within an Office document parser. When the parser encounters a specifically structured field, it dereferences a length or offset value derived from attacker-controlled input without validating that the resulting read stays within the allocated buffer. This mirrors a common pattern in complex binary and compound file format parsers where structural metadata drives read offsets.

Attack Vector

An attacker crafts a malicious Office document and delivers it to a target through phishing, a shared link, or a compromised file share. When the victim opens the document in a vulnerable version of Word, Excel, PowerPoint, or another affected Office application, the parser triggers the out-of-bounds read. The attacker then extracts leaked memory through a channel such as a subsequent server callback, embedded object, or interpreted document field. No verified public exploit code or proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. See the Microsoft Security Update CVE-2026-80089 advisory for vendor-provided technical details.

Detection Methods for CVE-2026-80089

Indicators of Compromise

Unexpected Office documents received via email from untrusted senders, especially with unusual embedded objects, external references, or malformed structural elements.
Office application processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) initiating outbound network connections to unknown domains shortly after opening a document.
Crash telemetry or Windows Error Reporting entries referencing access violations in Office parsing modules.

Detection Strategies

Inspect inbound email attachments and web downloads for Office documents with anomalous structure, oversized fields, or malformed compound file streams.
Correlate document-open events with subsequent child-process or network activity spawned by Office applications to identify staged information exfiltration.
Deploy YARA or content inspection rules aligned to malformed OOXML and Compound File Binary Format (CFBF) structures targeting Office parsers.

Monitoring Recommendations

Enable Microsoft Office telemetry and forward Office ETW events to a central Security Information and Event Management (SIEM) platform for analysis.
Monitor for outbound connections from Office processes to newly registered or low-reputation domains.
Track patch compliance across Microsoft 365 Apps, Office 2016, 2019, 2021 LTSC, and 2024 LTSC endpoints and alert on unpatched hosts.

How to Mitigate CVE-2026-80089

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-80089 advisory to all affected Office installations.
Prioritize patching for users who routinely handle externally sourced documents, including finance, HR, and executive assistants.
Reinforce user awareness on opening unsolicited Office attachments and enable Protected View for files originating from the internet.

Patch Information

Microsoft released security updates for Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021 LTSC, and 2024 LTSC. Consult the Microsoft Security Update CVE-2026-80089 advisory for specific build numbers and deployment guidance for each channel and platform.

Workarounds

Keep Protected View and Office Application Guard enabled to isolate untrusted documents from the host environment.
Block or quarantine Office documents from external senders at the email gateway when the sender or attachment fails reputation and structural checks.
Use Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes or injecting into other processes, limiting post-exploitation options.

bash

# Enable Microsoft Defender ASR rules that limit Office post-exploitation behavior
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled