EUVD-2026-29638
GHSA-m7q8-mvmc-97p3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:L because exploitation requires opening a local file; UI:R for mandatory document-open interaction; PR:N as no system privileges needed to craft or trigger; C:H for meaningful local file disclosure; I/A:N as no write or availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
AnalysisAI
Local file disclosure in Microsoft Word exposes sensitive files and directories to external parties when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across version ranges confirmed by NVD CPE data. No public exploit code has been identified and CISA SSVC rates exploitation as none with only partial technical impact; a vendor-released patch is available via the Microsoft Security Response Center.
Technical ContextAI
CWE-552 (Files or Directories Accessible to External Parties) describes a class of flaw where an application exposes internal file system paths or content to entities outside its intended trust boundary. The 'Path Traversal' tag in the intelligence data suggests that Microsoft Word's document processing engine - likely its handling of linked objects, embedded content, field codes, or template references - improperly resolves or exposes local file system paths when processing a crafted .docx or .doc file. Affected CPEs confirm all major Office release trains: cpe:2.3:a:microsoft:microsoft_word_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, and cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise. The root cause is an insufficient access control on file or directory references embedded within Word document structures.
RemediationAI
Apply the vendor-released patch immediately via Microsoft Update or the Office Deployment Tool. For Microsoft Word 2016, update to version 16.0.5552.1000 or later. For Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise, follow the guidance at https://aka.ms/OfficeSecurityReleases and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35440. As a compensating control where immediate patching is not feasible, configure Protected View to open all documents from external sources in read-only sandbox mode, which may prevent the exploitation of file reference processing. Additionally, deploying Microsoft Defender Attack Surface Reduction (ASR) rules to block Office applications from creating child processes or accessing the file system beyond expected paths can limit the disclosure surface. Note that ASR rules may impact macro-dependent workflows, so test in audit mode before enforcing. Organizations handling particularly sensitive data should also consider monitoring for anomalous outbound connections originating from winword.exe as a detection control.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today