EUVD-2026-29645
GHSA-wj5j-v4x9-fvq4
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local file-parsing overflow needs the victim to open a crafted document, so AV:L and UI:R; no prior privileges (PR:N) and full user-context compromise gives C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
AnalysisAI
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps for Enterprise, Office for Android, and Office LTSC for Mac 2021/2024) stems from a heap-based buffer overflow that lets an attacker run arbitrary code with the victim's privileges. The flaw was reported by Microsoft, a vendor patch is available, and there is no public exploit identified at time of analysis; EPSS is very low at 0.04% and CISA SSVC records exploitation as none. Impact is total (full confidentiality, integrity, and availability loss) but exploitation is not automatable and, per typical Office file-parsing bugs, hinges on processing attacker-supplied content.
Technical ContextAI
The root cause is CWE-122, a heap-based buffer overflow: Office's document-parsing code writes past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or objects and enabling control-flow hijack that leads to arbitrary code execution. The CPE set confirms the affected components are the Office application suite across Windows (Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024), Android (Office for Android), and macOS (Office LTSC for Mac 2021 and 2024), indicating the vulnerable parsing logic is in shared cross-platform code rather than a single OS-specific module. Such overflows typically occur while deserializing a malformed file format element, where a length field or record size is trusted without adequate bounds validation before a copy into a fixed heap buffer.
RemediationAI
Apply the vendor-released patches, which are available per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40363. Specific fixed builds include Microsoft Office 2016 16.0.5552.1000, Microsoft Office for Android 16.0.19822.20190, and Microsoft Office LTSC for Mac 2021/2024 16.109.26051019; for Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024, install the current Office security update tracked at https://aka.ms/OfficeSecurityReleases (exact build follows your update channel). For 365 Apps, ensure automatic updates are enabled so the patched build deploys via your Click-to-Run channel. Until patching completes, reduce exposure by opening untrusted documents in Protected View and keeping it enabled (side effect: users must explicitly enable editing), blocking or quarantining Office file types at the mail gateway, and enabling Attack Surface Reduction rules that constrain Office child-process creation (side effect: may break legitimate macros or automation). See VulDB at https://vuldb.com/vuln/363177 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-40363 for cross-reference.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today