Out-of-bounds read in Microsoft 365 Apps for Enterprise and Microsoft Office - CVE-2026-80084

Vulnerability details

The vulnerability allows a remote attacker to disclose information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Outlook when handling attacker-supplied content over a network. A remote attacker can send crafted content to disclose information.

Successful exploitation can expose small portions of heap memory. User interaction is required. The Preview Pane is not an attack vector.

Affected software

How to mitigate CVE-2026-80084

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-80084
• https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office