CVE-2026-80091: Microsoft 365 Apps Information Disclosure

CVE-2026-80091 Overview

CVE-2026-80091 is an information disclosure vulnerability in Microsoft Office caused by the use of an uninitialized resource [CWE-908]. An unauthorized attacker can exploit the flaw over a network to disclose sensitive information from a victim's system. Exploitation requires user interaction, typically by opening a specially crafted Office document. The vulnerability affects multiple Office releases across Windows and macOS, including Microsoft 365 Apps and Office LTSC editions. Microsoft published the advisory on the 2026 Patch Tuesday cycle and has issued security updates for all supported versions.

Critical Impact
Successful exploitation exposes memory contents that may contain sensitive data such as document fragments, credentials, or pointers useful for chaining further attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS)
Microsoft 365 for macOS

Discovery Timeline

2026-09-08 - CVE-2026-80091 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80091

Vulnerability Analysis

The vulnerability stems from Microsoft Office reading a resource before it has been initialized. When Office parses a crafted document, uninitialized memory is returned to the attacker-controlled content path. The attacker can then extract residual data from process memory. Because the flaw is triggered through standard document handling, no elevated privileges are required on the target system. The attack does require user interaction, meaning a victim must open or preview the malicious file. The EPSS score of 0.707% places the vulnerability in the 51st percentile of exploitation likelihood at publication.

Root Cause

The root cause is a CWE-908: Use of Uninitialized Resource condition inside an Office file parser. A memory buffer or object field is consumed before an initialization write occurs. The contents of that buffer reflect prior allocations in the Office process heap. Attackers can shape document structures to increase the likelihood that sensitive data occupies the uninitialized region at read time.

Attack Vector

The attack vector is network-based delivery of a malicious Office document. Common channels include phishing email attachments, links to files on attacker-controlled shares, and documents embedded in web pages. When the victim opens the document in Word, Excel, PowerPoint, or another affected Office application, the parser triggers the uninitialized read. The leaked bytes can be exfiltrated back to the attacker through embedded content, external references, or serialized output within the document.

No public proof-of-concept code is available for this vulnerability. Refer to the Microsoft Security Update for CVE-2026-80091 for authoritative technical details.

Detection Methods for CVE-2026-80091

Indicators of Compromise

Office documents from untrusted senders that contain unusual embedded objects, external references, or malformed structures designed to trigger parser edge cases.
Outbound network connections initiated by WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE to previously unseen domains shortly after a document is opened.
Office processes reading files from temporary or download directories immediately followed by external network requests.

Detection Strategies

Inspect inbound email attachments for Office file formats with anomalous OLE, RTF, or OOXML structures using content-aware sandboxing.
Correlate document open events with subsequent child process activity and outbound traffic from Office applications.
Deploy behavioral analytics that flag Office processes making unusual DNS queries or HTTP requests after opening attachments.

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction rules that restrict Office applications from creating child processes and network connections.
Ingest Office telemetry, endpoint process events, and email gateway logs into a centralized SIEM for cross-source correlation.
Alert on repeated document open failures or parser crashes across multiple hosts, which may indicate exploitation attempts.

How to Mitigate CVE-2026-80091

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-80091 to all affected Office installations without delay.
Verify update deployment across managed endpoints, including macOS clients running Microsoft 365 and Office LTSC.
Reinforce user awareness for handling unsolicited Office attachments and previewing files from unknown senders.

Patch Information

Microsoft has released fixes through the standard Office update channels. Consult the Microsoft Security Update for CVE-2026-80091 for exact build numbers per product and channel. Ensure Microsoft 365 Apps clients are on the current or monthly enterprise channel build that includes the fix, and confirm click-to-run updates have completed on end-user devices.

Workarounds

Enable Protected View and Application Guard for Office to isolate documents originating from the internet or email.
Block or quarantine Office documents from external senders at the email gateway when they contain embedded objects or macros.
Configure Office Trust Center settings to disable automatic content activation and external content loading for untrusted files.

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f