CVE-2026-80078 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office installations, particularly those with network exposure, should assess vulnerability and prioritize remediation.

Why it matters

CVE-2026-80078 is a medium-severity vulnerability in Microsoft Office that requires defenders to assess exposure, prioritize remediation, and verify patching to prevent potential information disclosure over the network.

• Potential information disclosure over the network
• Need to verify patching and configuration of Office applications
• Potential impact on data confidentiality

Technical summary

CVE-2026-80078 is an out-of-bounds read vulnerability in Microsoft Office that allows unauthorized information disclosure over a network. The vulnerability has a CVSS score of 6.5 and is considered medium severity. It affects Microsoft Office installations, particularly those with network exposure. Defenders should assess exposure of managed Office installations and prioritize remediation based on network exposure. The vulnerability requires defenders to review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium priority for patching and verification

Recommended defensive actions

• Assess exposure of Microsoft Office installations to CVE-2026-80078
• Prioritize and apply patches for affected Office versions
• Verify patching and configuration of Office applications

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Microsoft has released a patch and vendor advisory. The vulnerability has a CVSS score of 6.5 and is considered medium severity. There is no information on known or unknown affected scope beyond the official advisory. Defenders should verify patching and configuration of Office applications according to vendor guidance and review the supplied official advisory or CVE record to validate affected scope, severity, and to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.