EUVD-2026-35508
GHSA-qx8j-c4w9-7qr2
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office stems from a type confusion condition (CWE-122 heap-based memory corruption per tags) that allows an unauthorized attacker to run arbitrary code on the host. The CVSS 8.4 vector indicates local attack vector with no privileges or user interaction required, and no public exploit is identified at time of analysis. The flaw was reported by Microsoft's MSRC and disclosed via the official update guide.
Technical ContextAI
The vulnerability is rooted in CWE-122 (heap-based buffer overflow) realized through a type confusion primitive - Office code accesses a memory resource as one type when it was actually allocated or initialized as another, causing out-of-bounds heap reads/writes that corrupt adjacent objects (function pointers, vtables, or COM interfaces). Microsoft Office's document parsers (Word, Excel, PowerPoint, Outlook preview pane) historically expose this class of bug via complex binary formats (OLE/CFB, OOXML embedded objects, RTF, EMF) and embedded scripting/COM type marshaling. Successful triggering of the type confusion grants attacker-controlled writes that pivot to native code execution within the Office process context.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-47635 published through the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47635 via Microsoft Update, WSUS, Intune, or Click-to-Run channels as appropriate for each Office edition; specific KB/build numbers were not included in the input data and must be retrieved from the advisory. As compensating controls until patching completes, enforce Protected View for files from the Internet and Outlook attachments (side effect: users must explicitly enable editing, breaking some macro-driven workflows), enable Attack Surface Reduction rules such as 'Block Office applications from creating child processes' and 'Block Office applications from injecting code into other processes' via Microsoft Defender (side effect: may interfere with legitimate add-ins or automation), block inbound Office document file types at the email gateway or quarantine for sandbox detonation (side effect: business friction with external partners), and disable embedded object/OLE handling via Group Policy for the affected file formats where business processes permit (side effect: breaks documents that rely on embedded spreadsheets or charts).
More in Office 2024
View allHeap-based buffer overflow in Microsoft Office Word enables local code execution with full user-level impact when a vict
Code execution in Microsoft Word stems from a numeric truncation error (CWE-197) in the document processing engine, affe
Heap-based buffer overflow in Microsoft Office Word enables arbitrary local code execution when a user opens a specially
Stack-based buffer overflow in Microsoft Office Word enables local arbitrary code execution when a user opens a maliciou
Use-after-free memory corruption in Microsoft Office Word enables local code execution when a user opens a specially cra
Heap-based buffer overflow in Microsoft Office Word enables local code execution with High confidentiality, integrity, a
Code execution via buffer over-read in Microsoft Office Word affects multiple Windows and Mac Office product lines when
Stack-based buffer overflow in Microsoft Office Word enables arbitrary code execution when a victim opens a specially cr
Remote code execution in Microsoft Office Outlook stems from a heap-based buffer overflow (CWE-122) that lets an unauthe
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) that a remote attacker
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code on a vi
Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality dat
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today